Let's say there's a domain name that is currently unregistered, that I want to purchase with the intention of re-selling for a profit, and I want to determine which variations of the name are also available.

Is it "safe" for me to check availability of several domain names through tools like https://www.whois.com/, or do I risk others seeing my queries and "stealing my ideas", potentially snatching up my potential golden eggs before I have a chance to register them? (...especially if others have recently queried the same domains?)

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data), but as I understand it, I can use sites like:

http://www.whois . {pick a top-level-domain}
such as .com, .net, .ru, .uk, .info etc.

...as a neutral, trustworthy authority for that TLD, even government-sanctioned in the case of country-code TLD's) and therefore can be trusted to not do shady stuff like that?

Is this true?

  • 1
    See this related question which focuses on how do I check that a domain is available without triggering a grabber versus if it's true... (I'm pointing out the difference to avoid having it marked as a duplicate) – dan Oct 17 '18 at 8:08
  • I'm not sure I see the difference between the two questions. The other one presumes it is true and has methods for avoiding the problem. This question asks if it is true and asks for methods for avoiding the problem. That is close enough to be duplicate. – Stephen Ostermiller Oct 17 '18 at 12:40
  • 1
    Yes, set it in tcp/ip properties. You still not safe if use some online tools, cause they don't use your dns setting, so avoid using them at all. Use any local software. Mocrosoft whois is fine. Also if you point your browser or similar software to some domain, its safe now. – LeonidMew Oct 20 '18 at 13:27
  • 1
    @LeonidMew - I got it setup.. And I can just use from now on, with various benefits and no ill effects; how have I never heard of this before?! Thanks very much, your comments were the missing puzzle pieces I needed. – ashleedawg Oct 20 '18 at 13:31
  • 1
    I'm not sure, something more verbose. I'm using whois on Linux, which is different. – LeonidMew Oct 20 '18 at 13:40

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data),

This is widely shared as an hypothesis/assumption/observation but yet it was never really formally proved. It does not mean it is not true, just that it is difficult to prove with 100% certainty.

If I remember correctly the only real study of it kind of proved the opposite but this is hard to do properly and it goes against so many people impressions, that they can not believe it: they persuade themselves that they put the domain name in one form online only and it got registered after then making the conclusion that the website where this form was stole their domain, forgetting that in fact their idea may have been already shared elsewhere, that they are using various tools that leak data (from browser extensions, to cloud tools, to network sniffers, etc...), and at the end that, like in science, it does happen for two unrelated person to get the same idea approximatively at the same time.

But there is not need to prove it or the opposite because there is no need for one to put itself under this problem.

To solve your query about checking if a domain is available or not there is only one foolproof way to do it (besides trusting a specific registrar and ask him to check for you because he will be able to use its specific connections to the registry, which are not public, but give realtime availability answers):

  1. Go to https://www.iana.org/domains/root/db: this is the authoritative source of all currently existing (published) TLDs.
  2. Select the one you are concerned with, and in its page on IANA website you will see details about which is its registry, with a link to its website, as well to its whois servers
  3. (note in passing that there are other ways, more empiric, to find the whois servers of a given TLDs, I detailed most of them in my answer here: https://unix.stackexchange.com/a/407030/211833)
  4. Now you can either try to do a whois on the registry website, or do a whois on port 43 but with option -h (typically, check your client) to contact directly the registry whois server and no other (of course this latter case is still vulnerable to anyone being able to sniff the network path between you and the whois server as this communication is not secured in anyway, every piece of data goes in the clear)

If you do the above, you reduce the number of intermediaries and third parties that are unneeded. Hence you lessen your risk.

Everything else for me is "unsafe", as you are given your data to a third party. It may or may not behave like you want it to behave. Since there are never 100% guarantees, why take the chance?

Also for names you deem highly valuable the usual advice of course is not to wait: instead of checking for them and then decide to register them days or weeks later, check for them and register immediately. This also lessen your risk quite a lot.

As for

I assume that domain reselling companies absolutely track which domains are being checked (it would be silly of them not to capitalize on that data),

there is some kind of ambiguities because it is not clear what you put behind "reselling companies".

In the classical (but not without exceptions) model you have, per TLD: - one registry - a certain number (in the hundreds or couple of thousands at most) of registrars under contract with the registry and the only one having a connection to it for all domain name operations - a very much larger number of resellers, that is any third party that is either under contract with a registrar, or just uses its website/API. They can be webhosting companies, trademark protection agencies, integrated services providers, etc.

In the gTLD world, on top of the above, the registry and the registrars are under contract with ICANN. In that model, registrars are forbidden to register domain names for themselves they can operate only on behalf of their client. Which has normally the corrolary that, even if they monitor the checks done, they can not register the domains in place of their clients. Of course there were historical counter examples of that.

But the main point is that there are no such contracts and rules at the resellers level. Those companies can do pretty much what they want: if you give them your data through your use of their website it is already potentially too late. There may be even some silly footprints on the website that disculpes them of any wrongdoings if they use your data because you are deemed to have accepted them to do whatever they please with it as soon as you used their tools/website.

So, again, do not use unneeded third parties. Either you have one registrar you fully trust and you do everything through it. Or purely for check availability you use only the registry whois server or website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.