Why are my state and country still public at Cloudflare?

Cloudflare's public WHOIS output keeps the registrant state or province and country visible while hiding many other personal contact fields. Redaction does not necessarily hide every part of a postal address.

Can I choose to publish my own redacted contact details?

A gTLD registrar applying the relevant redaction rules must offer the holder a way to consent to publication of the covered registrant fields. It must publish the specific values the holder agrees to disclose; consent to one field does not mean consent to every field.

Where can I report abuse involving a domain that uses a privacy service?

Use the registrar's published abuse contact or the affiliated privacy or proxy provider's abuse reporting contact. These channels handle abuse reports without requiring you to obtain the registrant's private address first.

Does listing a company automatically make all contact data public?

No. A gTLD registrar or registry is not required to treat company registrations separately when applying permitted redaction. Listing a company does not automatically make every contact field public.

Why does a redacted RDAP entry have no method field?

In the redacted extension, an omitted method means removal by default. The absence of that member is not itself a malformed redaction entry.

Why does a redacted RDAP entry have no reason field?

The reason member is optional in the redacted extension. A missing reason therefore does not by itself mean the server failed to identify the field as redacted.

Why does an RDAP prePath expression find no value in the public response?

A prePath expression points into the response before redaction, so it may not resolve after a field has been removed or replaced. The redacted entry's name can identify the hidden field without recovering its private value.

Why is an RDAP contact name empty instead of deleted?

In a JSON contact record called jCard, the fn name property is required. During redaction, its text value is left empty while the required property and array positions remain intact.

Does Cloudflare redact contact details for .us domains?

No. The .us registry requires public domain contact data and prohibits WHOIS redaction and privacy services. Cloudflare's standard redaction option cannot override that extension's rule.

What must a request for nonpublic gTLD registration data include?

A request for nonpublic gTLD registration data needs the requester's identity and contact details, the particular fields sought, and the legal rights and reasons supporting the request. It also needs good-faith and lawful-processing confirmations, plus authorization evidence when someone acts for another party. Follow the registrar's published request format.

WHOIS Privacy vs RDAP Redaction Explained

A public domain lookup can hide a registrant's contact details for more than one reason. The registrar may redact personal data from a public response, or a separate privacy or proxy service may supply alternate public contact information. Those arrangements differ in who is named as the registered holder, what the provider stores privately, and how messages can reach the customer.

The label WHOIS privacy is often used loosely at checkout. Ask what the provider actually offers. A redacted WHOIS or RDAP display is not proof that a proxy service holds the name, and paying for a privacy service does not remove your obligation to keep registration data accurate. The available service and public fields depend on the registrar, service terms, and rules for the domain's extension.

Identify Who Is Registered

With a privacy service, the customer remains the registered domain name holder, while the provider supplies alternate, reliable contact details for the public directory. With a proxy service, the proxy provider becomes the registered holder of record and licenses use of the name to its customer. That difference affects the service agreement and the rights and responsibilities attached to the registration.

Redaction is different. The registrar or registry can retain the underlying registration information while omitting or replacing selected values in a public lookup. Cloudflare Registrar, for example, hides many personal contact values in its public WHOIS results where the registry permits redaction. It keeps the complete registration record privately. Another registrar or extension may expose different fields, so compare the public result with the service you actually have.

To know which arrangement applies, inspect the registration agreement and the provider's privacy or proxy terms. Ask who is the holder of record, which contact is supplied to the registry, who can renew or transfer the name, and what happens if the service is canceled. Do not infer the legal relationship from a marketing badge or a missing public email field.

Separate Private Records from Public Fields

Public registration data may still show the domain, registrar, status, important events, and name servers even when personal contact values are hidden. Some contact elements may remain visible according to the operator and policy. The authenticated registrar account can show more information to the authorized customer than an unauthenticated public RDAP or WHOIS query. Visibility and correctness are separate questions.

For generic top-level domains (gTLDs), registrars collect required registration details separately from what they publish. When redaction rules apply, hidden values must be omitted from the public output and identified as redacted. For a domain using an affiliated or accredited privacy or proxy service, the public record must contain that service's full registration data and may include a forwarding address. The private underlying record and the public service contact can therefore contain different details.

Keep required contact information accurate and reachable with the registrar. A redacted address may still be used by the provider for verification, renewal, transfer authorization, or support. If it is wrong, privacy settings will not correct missed notices or failed approvals. Make authorized changes through the registration account and confirm the stored values privately.

Read RDAP Redaction Metadata

Registration Data Access Protocol (RDAP) provides structured registration records. Its redacted extension identifies fields hidden under the server's policy. Four methods are available: removing a field, leaving an empty value, showing only part of a value, or substituting another value. A redacted entry identifies the affected field and can describe the method. This metadata distinguishes a deliberately hidden value from data that the response lacks for another reason.

Do not assume that every missing field is marked by this extension or that every lookup service displays the same details. A server may omit a redaction signal if revealing that the data exists would itself create a privacy concern. A lookup interface may also simplify the underlying JSON, the structured text format of an RDAP response. If the displayed result is ambiguous, compare it with the raw response and ask the registrar how the field was handled.

The technical redaction method is not itself a paid privacy product. It describes how a public response is formed. A registrar might apply required redaction without enrolling the customer in a separate proxy arrangement. A privacy or proxy service, by contrast, has its own agreement about alternate contact, message handling, and the holder of record.

Understand Relay and Disclosure Limits

Hiding a contact email from public view does not always make the registrant unreachable. For a gTLD registrar applying the relevant redaction rules, the public record must offer an email address or web form for contact without exposing the underlying email or identifying the contact. Cloudflare provides a message form that forwards inquiries to the registrant email on file. Other providers may use different relay arrangements, filters, or terms. For a domain you manage, verify that the published route reaches the intended mailbox.

A privacy or proxy provider affiliated with an accredited registrar must publish and follow its service terms, including procedures for communications, service termination, and publication of customer data. Read the conditions for forwarding messages and ending protection. A request for nonpublic information does not automatically entitle the requester to receive it. The registrar or registry evaluates a properly submitted request against the relevant rules and the reasons given.

Do not present a hidden public record as anonymous ownership or immunity from contact. Account providers and service operators can still hold information needed for the registration and may process lawful requests under their obligations. For a proxy arrangement, review the provider's control and termination terms carefully because the provider is the holder of record.

Verify the Coverage You Actually Have

In the registrar account, identify whether you enabled a named privacy service, a proxy service, or only standard public-data redaction. Review the holder of record, the provider's terms, the contact relay, and which extensions the service covers. Then compare a public WHOIS or RDAP result with the authenticated account view, without posting private values elsewhere.

If public information surprises you, record the affected field, lookup source, and query time without copying private values into a public ticket. Ask the registrar whether that field was published, redacted, replaced, or supplied by a separate service, and why. Correct inaccurate private data through the account, then compare the relevant public field again after the provider confirms the update.