What Is WHOIS Privacy, and Should I Enable It?

When you register a domain, your name, address, phone and email are recorded in a public database called WHOIS. WHOIS privacy (ID Protection, Domain Privacy) is a service that hides this information from everyone and shows the provider's proxy details instead.

What is WHOIS and what is it for?

WHOIS is an international registry system that holds the answer to "who owns this domain?". ICANN rules require every domain owner to provide valid contact information. The purpose: to be able to reach the domain owner in legal disputes, abuse complaints and technical issues.

The problem: this information can be seen by anyone with the whois yoursite.com command or from any WHOIS lookup site.

What does WHOIS privacy do?

With privacy on, a WHOIS lookup shows the following instead of your details:

Registrant Name:    Privacy Protection / Redacted for Privacy
Registrant Email:   [email protected]
Registrant Phone:   +1.5555555555

The domain is still yours and you have full control; only the public record is masked. Legitimate notices sent to you (legal notice, transfer approval) are forwarded to you through the proxy email.

Should I turn privacy on?

Advantages of turning it on

Less spam and fraud: WHOIS data is scanned constantly; leaving it open invites fake "renew your domain" emails and phone calls.
Personal privacy: your home address and phone number are not exposed to everyone. Especially important for individual/personal projects.
Protection against phishing and social engineering.

When should it be left off / is it left off?

Corporate transparency: some companies keep their company details public for trust (they are already listed in the trade registry anyway).
Not supported for some extensions: .com.tr, .tr and some country extensions do not allow WHOIS privacy. Your registration details are visible for these extensions — though many partially mask the address for individual registrations.
SSL certificate validation: when getting an organisation-validated (OV/EV) SSL, WHOIS data may be checked; you might need to turn privacy on temporarily.

Relationship with GDPR / KVKK: Since 2018 many registries already partly hide the WHOIS data of natural persons by law (especially European extensions). Even so, a separate privacy service is needed for full masking; automatic "redaction" does not apply to every extension and every field.

How is it turned on/off?

From the domain panel, select the domain → turn the "WHOIS Privacy" / "ID Protection" option on or off. The change usually appears in WHOIS within a few minutes to a few hours. For supported extensions this service is free or very low cost at most providers.

Care when selling a domain

If you plan to sell the domain, turning privacy off temporarily during the sale — or leaving a contact route in WHOIS — helps the buyer reach you. Once the sale completes, the new owner makes their own choice.

At Arcnar: For supported extensions, WHOIS privacy is on by default. From Panel → Domains → your domain → Whois tab you can see the status and update your registration contact details. For .tr extensions the information stays visible because privacy is not supported by the registry.

Frequently asked questions

Is WHOIS privacy paid?

For supported extensions it is free or very low cost at most providers. At Arcnar it is on by default for supported extensions and no extra fee is charged.

Is my domain still mine while WHOIS privacy is on?

Yes. Privacy only masks the contact details shown in a public WHOIS lookup. Ownership, management and all rights to the domain remain with you; you perform transfer, DNS and renewal operations normally.

Does WHOIS privacy work on a .com.tr or .tr domain?

No. .tr extensions (.com.tr, .net.tr, .org.tr, etc.) do not support WHOIS privacy at the registry (nic.tr) level; your registration details are visible when queried. The address may be partly masked for individual registrations, but a full privacy service is not offered.

What happens if I leave my WHOIS details public?

Your name, address, phone and email can be queried by anyone. In practice this means more spam email, fake "domain renewal" invoices and phone fraud attempts using data collected by automated bots.