In this guide · 8 sections
- 01What is WHOIS privacy?
- 02What a lookup shows today: .com vs .sg
- 03What a privacy service adds, and what it doesn't
- 04Spam and scam emails: what privacy can't stop
- 05Keep your contact email reachable for renewals
- 06Should a business turn WHOIS privacy on?
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
For most business domains, WHOIS privacy is optional. Generic domains like .com already redact personal contact data under ICANN's policy, and .sg lookups mask email and phone. What matters more is that the registrant is your company and the contact email is one you read and can recover.
What is WHOIS privacy?
Every domain has registration data: who holds it, which registrar manages it, when it expires and which nameservers it uses. WHOIS was the old public lookup for that data. For generic top-level domains (.com, .net, .shop and others), it has been replaced by RDAP, a newer protocol. ICANN's RDAP page says registries and registrars are no longer required to provide WHOIS services as of 28 January 2025.
"WHOIS privacy" (also sold as domain privacy or privacy protection) is a registrar service that replaces your contact details in that lookup with the details of a privacy or proxy service. Some registrars include it free; others charge a yearly fee.
What a lookup shows today: .com vs .sg
The rules differ by domain ending. For generic domains, ICANN's Registration Data Policy, effective 21 August 2025, sets what registrars publish and what they may redact. For .sg, SGNIC sets the rules.
| Data | .com and other gTLDs (ICANN policy) | .sg (SGNIC) |
|---|---|---|
| Registrar, dates, status, nameservers | Always published | Published, plus VerifiedID@SG status |
| Registrant country and state | Published | Not shown |
| Registrant organisation | Published if you agree; otherwise may be redacted | Shown as Registrant Name |
| Registrant name, street, phone | Redacted where law requires or registrar chooses | Name shown (a person's name if a person registered); address and phone not shown |
| Registrant email | Replaced with an anonymous email or web form if redacted | Masked (since 1 June 2005) |
| Technical contact | Name and phone may be redacted | Tech name and email shown, for quick technical fixes |
| NRIC or ID numbers | Not applicable | Never displayed |
The SGNIC FAQ says it follows the industry practice of showing contact details, does not display sensitive data such as NRIC numbers, and has masked email addresses and phone numbers under the registrant, administrative and billing contacts since 1 June 2005 to curb spam. The technical contact is the exception. To see what your own domain shows, use ICANN Lookup for generic domains or SGNIC's WHOIS search for .sg; our guide on who owns my domain walks through both.
What a privacy service adds, and what it doesn't
With redaction now common, a privacy add-on mainly matters where your registrar does not redact by default, or where you want your company name hidden too.
Pros
- Hides your organisation name, address and phone where the registrar would otherwise publish them
- Cuts unsolicited sales calls and letters tied to published contact details
- Useful for sole proprietors who registered with a home address
- Often free with the registration at many registrars
Cons
- Doesn't stop scam renewal letters, which use public domain lists
- Hides less than it used to, since ICANN policy already redacts much personal data
- Some registrars charge yearly; check before renewing
- Under ICANN policy, the privacy service's details are published in place of yours, so customers can't see your business is the holder
ICANN's policy also gives everyone a way to reach you without exposing your address: where email is redacted, the registrar must publish an anonymous email address or a web form that forwards to the contact. And registrars must handle disclosure requests from people with a legitimate reason, such as lawyers in a trademark dispute. Privacy is not anonymity.
Spam and scam emails: what privacy can't stop
Many business owners buy privacy to stop the "your domain is expiring" letters and emails. That rarely works. Scammers don't need your WHOIS record: newly registered domain names, expiry dates and registrar names remain visible, and your contact email is usually on your own website.
Keep your contact email reachable for renewals
Hiding contact data is far less important than keeping it correct. Registries and registrars use it to verify you and to warn you before expiry, and wrong details can get a domain suspended.
- Generic domains: ICANN's 2013 Registrar Accreditation Agreement requires registrars to verify changed contact details. If the holder doesn't confirm within 15 calendar days, the registrar must verify manually or suspend the domain.
- .sg domains: under VerifiedID@SG, the administrative contact must verify identity within 21 calendar days of registration, or SGNIC suspends the domain. A 7-day extension can be requested.
- Renewal reminders go to the account and registrant email. If that is an ex-employee's or an agency's address, nobody sees them.
Domain contact settings to check today
Should a business turn WHOIS privacy on?
For a company with a registered office address, privacy adds little. For a sole proprietor or home-based business that registered with a home address and mobile number on a generic domain, it is worth switching on if your registrar does not already redact those details.
If you are choosing where to register or move your domains, compare whether privacy is free and how the registrar handles security features like registry lock. Our guide to the best domain registrars in Singapore covers this.
Do it yourself or get help?
Checking your own lookup result and turning privacy on or off takes a few minutes in your registrar account. The more valuable job is confirming the registrant, contacts, auto-renew and DNS are all in your control.
Our Domain & DNS Setup (S$99) checks who holds the domain, updates contacts to addresses you control, sets up auto-renew and cleans up DNS records.
Frequently asked questions
Usually not for a company. Generic domains like .com already have personal data redacted under ICANN's Registration Data Policy at many registrars, and .sg lookups mask email and phone. Pay for privacy only if your registrar would otherwise publish a home address or personal phone number, and check whether it is offered free.
Not fully. SGNIC masks email addresses and phone numbers for registrant, administrative and billing contacts and never shows NRIC numbers, but a .sg lookup still shows the registrant and admin names, plus the technical contact's name and email. If a person registered the domain, their name is public. .sg registration also requires identity verification through VerifiedID@SG.
Rarely. Scammers use publicly visible domain names, registration dates and registrars, plus contact details from your own website. The protection is knowing your real registrar and renewal date, and paying only inside your registrar's account. Treat any unexpected invoice or renewal notice from an unknown company as suspicious.
No. Ownership follows the registrant recorded with the registrar, even if a privacy service is shown publicly. Make sure the registrant is your company and that you control the registrar account. If an agency or former employee is the registrant, fix that first; hiding the record doesn't help in a dispute.
RDAP, the Registration Data Access Protocol, is the IETF-developed replacement for WHOIS. It returns the same kind of domain data in standard formats with better language support. ICANN says generic domain registries and registrars must provide RDAP and, since 28 January 2025, are no longer required to run WHOIS.