What Is Domain Privacy (and What Does WHOIS Show)?

WHOIS is the public record of who registered a domain name, and domain privacy is the layer that hides your personal details from it. Since Europe's GDPR and ICANN's Registration Data Policy (effective 21 August 2025), most personal fields are hidden by default, and registrars like Cloudflare now redact them for free. What still shows: the registrar, the dates, and your country.

What WHOIS actually is

WHOIS is the lookup system that publishes the registration details behind any domain. Query it and you see which registrar manages the name, its key dates, and when it expires.

Cloudflare describes it plainly: "WHOIS is a standard for publishing the contact and nameserver information for all registered domains. Each registrar maintains their own WHOIS service. Anyone can query the registrar's WHOIS service to reveal the data behind a given domain."

Historically that data included the registrant's name, email, phone, and postal address. All public. Anyone could read it.

That is the problem domain privacy solves. A public inbox and address attached to every domain is an open invitation to spam and unwanted sales calls.

What shows today, and what is hidden

Most personal contact details are no longer visible in a modern WHOIS record. The public data has shrunk to the parts a system genuinely needs, and the personal parts are masked.

Two changes drove this. Europe's data-protection law, the GDPR, forced the industry to stop publishing personal data, and registrars now redact those fields by default, in line with ICANN's Registration Data Policy. Under that policy, redacted personal fields are replaced with the string REDACTED or, at registrars like Cloudflare, Data Redacted. MYNIC's .my WHOIS shows REDACTED FOR PRIVACY.

What stays public is the operational layer, not the personal one.

Field	Public today?
Domain name, registrar, registrar URL	Shown
Creation and expiry dates	Shown
Nameservers and domain status	Shown
Registrant country and state	Shown
Registrant organization	Often shown (.my; gTLDs if the holder agrees)
Registrant name, email, phone, street	Redacted

Malaysia's .my registry did the same. Its WHOIS states that "personal information contained in domain name registration data is no longer displayed" for privacy reasons.

A third party with a legitimate reason can message the domain contact through MYNIC's Domain Contact Request form, without seeing the details. That masking also gives scammers fewer personal details to lift into fake renewal notices.

Domain privacy services versus built-in redaction

Domain privacy, sometimes sold as WHOIS privacy, is a service that publishes the provider's forwarding contact details in place of yours. It predates the GDPR era, when personal data was published by default and hiding it often cost extra.

There are two ways your details stay off the public record now.

Built-in redaction is the modern default. The registrar simply masks the personal fields, and ICANN requires that they still offer a way for a third party to reach you without exposing your identity. Cloudflare, for one, provides this free of charge, in line with current ICANN guidelines.

A paid proxy service goes one step further. ICANN puts it plainly: "The proxy service provider is the registrant of record". That means the proxy company, not your business, legally holds the name.

ICANN also says it "is implementing a new accreditation program for privacy and proxy service providers", so formal accreditation is still to come. For most Malaysian small businesses, the free redaction the registrar already applies is enough. A paid privacy add-on is an upsell you rarely need, whichever extension you registered.

One caution. Privacy hides your details from the public, never from your registrar or from a court order. It is not anonymity, and it is not a place to hide ownership from your own business.

Privacy is not the same as ownership

A private WHOIS record protects your contact details, not your control of the domain. This trips people up, because a redacted record hides the registrant's personal name.

For .my and .com.my names, MYNIC's WHOIS still shows the registrant organization, so a company-held domain usually shows the company, while one registered to a person shows almost nothing.

The first thing to confirm is still ownership, and redaction makes that harder to read at a glance. A pattern we see is a business that cannot tell whether it or a former vendor holds its own domain.

When the public record comes back blank, the real test is the account, not the page. Whose registrar login controls the domain, and can you sign in? That is the ownership question domain privacy can quietly obscure.

Frequently asked questions

Do I need to pay for domain privacy?

Usually not. Most registrars now redact your personal details from WHOIS for free, because ICANN's rules and Europe's GDPR pushed the whole industry to stop publishing personal data. A paid proxy service adds a layer, listing a proxy company instead of you, which also makes that company the legal holder of the name. For a typical Malaysian business, the free redaction already covers the spam and privacy concern. Check whether your registrar redacts by default before buying an add-on.

Does domain privacy hide who owns the domain?

It hides your details from the public, not the fact of ownership from you or the law. Your registrar still knows exactly who you are, and a court or dispute process can compel the details. Privacy stops strangers reading your name and address off a lookup. It does not make a domain anonymous, and it should never be used to obscure ownership within your own business.

Can I still be contacted if my WHOIS is private?

Yes. ICANN requires registrars that redact your data to keep a contact route open, often a relay email or a request form. A third party can reach you without ever seeing your identity. For .my domains, MYNIC routes legitimate requests through a Domain Contact Request form. So a private record does not cut you off from a genuine buyer, legal notice, or transfer request.

What information is still public in WHOIS?

The operational details, not the personal ones. A modern lookup still shows the domain name, the registrar, the creation and expiry dates, the nameservers, and the domain's status. It usually shows your country and state too, and for .my names often the registrant organization. Your name, email, phone, and street address are redacted. That public layer is enough to identify the registrar and the nameservers without exposing you.

How do I do a WHOIS lookup for a Malaysian domain?

Use any registrar's WHOIS tool, or MYNIC's lookup for .my and .com.my names. Enter the domain and you get the registrar of record, the dates, and the status, though the personal contact fields will read as redacted. If you need to know who controls the domain rather than who to email, the answer is whichever registrar account holds it, not the public record.

Read the record, then check the account

Storming Solutions builds custom-coded websites and maintains existing WordPress sites for businesses across Kuala Lumpur and the rest of Malaysia. Part of that is keeping every client's domain legible and in their own name, with redaction set up so your details stay private while ownership stays plainly yours.

Not sure what your domain's record shows, or who really controls it? Run a lookup, then read who should own your domain, or ask us for an ownership check. Our web development setup keeps your privacy and your control separate, the way they should be.