WHOIS history is the sequence of registration records a domain name has carried over its life: who was listed as the registrant at each point, which registrar sponsored it, which nameservers it used, and when each value changed. A current WHOIS lookup shows one record, and since 2018 that record usually shows a privacy service or a row of “REDACTED FOR PRIVACY” fields. The history is where the answers are, and this guide explains where it comes from, what it reveals, its limits, and how we assemble it.
What a WHOIS record contains
WHOIS (the public registration record for a domain name) answers one question: who is responsible for this name? A full record lists the domain, the sponsoring registrar, the creation, updated and expiration dates, the EPP status codes (registry flags such as clientTransferProhibited that control whether the domain can be transferred, updated or deleted), the nameservers, and, historically, four contact blocks: registrant, administrative, technical and billing, each with a name, organization, address, phone and email. Our explanation of domain name registration data and WHOIS walks through each field.
The contact blocks are the part that identifies an owner, and they are the part that disappeared. Since the EU General Data Protection Regulation took effect in May 2018 and ICANN adopted its Temporary Specification, registrars have redacted personal data from public records by default, and many registrants already used privacy or proxy services, which substitute the service’s name and forwarding address for the registrant’s. A current lookup of most domains therefore returns a registrar, dates, status codes and nameservers, and nothing that names a person or a company.
Where historical WHOIS records come from
No registry or registrar publishes a domain’s past records. Historical WHOIS exists because third parties captured the public records repeatedly over many years and kept the captures. We rely on four sources, and the strongest investigations use all of them.
Commercial WHOIS archives
Several commercial providers have queried the WHOIS servers of registries and registrars on a rolling basis since the early 2000s and stored every record retrieved. For a domain that existed before 2018, those archives hold dozens or hundreds of dated captures, most of them unredacted, because they were taken when the public record still carried full contact data. Redaction changed what is published going forward; it did not reach back into the archives. That is the single most important fact about domain WHOIS history: captures taken before May 2018 preserve ownership data that no live lookup can produce today. For domains registered after 2018, the archives still capture every change in registrar, dates, status codes and nameservers, plus whatever contact data the registrar published, which for many corporate registrants is still the organization name.
Registrar records
The registrar holds the complete, unredacted account history: who opened the account, from what IP address, every change to the contact data, every transfer authorization code issued, and every login. Registrars produce this in response to a subpoena, a court order, a law enforcement request, or in some cases a documented legitimate-interest request. For a theft recovery, those records are often decisive.
Archived web pages
Web archives preserve what a domain served at dated points in time, and those pages often identify the owner more plainly than a registration record: a company name in the footer, a privacy policy naming a legal entity, a contact page with an address. They also establish what the domain was used for during each period of ownership.
DNS history as corroboration
Passive DNS archives record the nameservers and IP addresses a domain resolved to on given dates. A registrant change that coincides with a nameserver and hosting change confirms that control actually moved; one with no DNS change often means the owner turned on a privacy service. We treat domain name DNS history as the second witness that confirms or qualifies the first.
What a historical timeline reveals
When the captures are laid out in date order, four patterns come up repeatedly.
Ownership changes
Each change in the registrant is a potential sale, reorganization or theft, and the context tells which. A registrant change with a registrar and nameserver change, after the domain was listed for sale, is consistent with an aftermarket purchase. A change from a long-standing company to a privacy service at a registrar in another country, with the nameservers moving to a parking page, is not.
The moment of a theft
In a stolen domain case, the timeline identifies the day, often the hour, when control passed. The sequence is typically a contact email change, removal of the transfer lock, a registrar transfer, then a change of nameservers, sometimes all within a day. The captures bracket that event: the last record under the rightful owner and the first under the thief. Those two records, with their timestamps, are the core exhibit in a recovery demand to the gaining registrar and in any later court filing. Our stolen domain name recovery service builds its case on exactly this evidence.
Abandonment and re-registration
A capture showing the domain in redemptionPeriod or pendingDelete status followed by a new creation date means the domain expired and was re-registered, and the creation date on the current record refers to the new registration, not the domain’s first life. A buyer who sees a creation date of 2021 may be looking at a domain first registered in 2003, dropped, and caught by a drop-catching service, a different asset with a different reputation. The patterns that distinguish a clean re-registration from a problematic one are collected in our guide to domain history red flags.
Limits of WHOIS history since 2018
Archive coverage is excellent for .com, .net and .org and thinner for some country-code domains whose registries restricted bulk access. For the post-2018 era, the archives capture structure and dates but rarely a person’s name.
The scale of the change is measured. Interisle Consulting Group’s WHOIS Contact Data Availability and Registrant Classification Study found that publicly available contact data fell from 82% of gTLD records in 2010 and 75.7% in April 2018 to 13.5% in 2020, with 57.3% of records redacted and 29.2% behind privacy or proxy services. Interisle’s gTLD Registration Contact Data Study of June 2024 found that only 10.8% of gTLD domains had identifying contact data for the actual registrant.
The WHOIS protocol itself has also been retired for gTLDs. ICANN’s 2013 Registrar Accreditation Agreement global amendment set 28 January 2025 as the WHOIS Services Sunset Date, after which registrars are no longer required to publish registration data over port 43 or web-based WHOIS, as recorded in ICANN’s reminder on the amendment’s effective date. Current lookups now go through RDAP, the Registration Data Access Protocol; our guide to RDAP versus WHOIS explains the difference. Historical WHOIS is unaffected, because the archives already hold the records.
Requesting data from a registrar or through ICANN
When the archives do not answer the question, the registrar can. ICANN’s policies require registrars to provide reasonable access to nonpublic registration data to parties with a legitimate interest, and ICANN’s Registration Data Request Service provides a standardized form that is routed to the registrar for a decision. A request should identify the domain, the requester, the legal basis (a trademark right, a theft claim, a pending proceeding), and the data sought. Courts obtain the same data by subpoena or order.
Expectations should be modest. The 2021 M3AAWG and APWG survey of 277 investigators, ICANN, GDPR, and the WHOIS: A Users Survey, Three Years Later, found that responses to disclosure requests within 24 hours fell from 11% in 2018 to 6% in 2021, that requests taking more than seven days rose from 36% to 61%, and that one brand protection firm reported only 10% of its 4,575-plus disclosure requests returned registrant data. A request is worth making where a dispute or a theft gives a clear legal basis, but an investigation cannot wait on it. The archives come first.
How DNAccess assembles a WHOIS history
We begin by pulling every available capture for the domain from the commercial archives we subscribe to and normalizing them into a single table of registrant, organization, registrar, nameservers, status codes and dates. We then mark each point where a value changed as an event. Next, we pull passive DNS history for the same period and align it against the events, confirming which registrant changes involved an actual transfer of control. We retrieve archived web pages from before and after each event to establish who was operating the domain and for what purpose. Where a legal basis exists, we prepare a disclosure request to the registrar or a subpoena for counsel to serve.
The client receives a dated ownership timeline, the source captures behind each entry, and a narrative explaining what the sequence means. For a buyer, that is the ownership section of a domain name background check. For an attorney, it is an exhibit set prepared to litigation standards, with Bill Hartzer available to explain the records as an expert witness. Background on the records is in our post on domain name registration history.
What DNAccess does
DNAccess assembles WHOIS history for buyers, brands and law firms as part of its domain name background check service, drawing on archives that predate redaction, passive DNS history, web archives and registrar disclosure. When the history shows that a domain was taken from its rightful owner, our stolen domain name recovery team uses that timeline as the foundation of the recovery. To request a WHOIS history for a specific domain, contact us.