But I do see your point. On the one hand, I'd suggest an optional "reach the owner" part of whois, where one could list a physical or digital address (doesn't even have to be email, I sometimes list social network presence on "about" pages as contact method for unimportant sites, to prevent spam). But on the other hand, we already have a place where you can optionally put your contact details: the very website we're talking about. And there you can apply any anti-spam measures you want, which you cannot do if it's in a public directory somewhere.
I think it's fine if people have to publish their contact info themselves.
If the registrar is in the middle, they have a considerable interest in failing to deliver sales inquiries, because they will tend to lose out on them. Same with certain types of abuse inquiries. The registrar has a conflict of interest with most forms of legitimate inquiry on a domain. If the registrar allows unfiltered messages, or messages whose content is entirely unknown to the registrar, then you're back to square one, because the end address ultimately has to filter the spam.
Simply write delivery into the contract, and require fees paid to the registrar from any party sending mail through the service (i.e. stamps).
Critically, if one were going to do this, allow the domain owner to black hole all communication via this path if they're not interested.
So ideally, in case they don't provide an email, one would not do that.
I get offers for my domains, all unwanted.
If I at some point decide to sell one of those to one of them, all the cold approaches from the past don't suddenly get legitimized.
edit: as I'm writing this, I remember that this is quite similar to the selling of social media IDs. Some random crypto start up decided that they should try to bully me to sell them my three letter Twitter handle. Really annoying.
My state department of motor vehicles maintains a database of vehicles registered in the state and the contact information for their owners. While they do not have a convenient website for querying this data themselves, they make it available to third parties in bulk, and I can obtain individual records for those third parties convieniently using their websites.
Both these databases are mandated by my state legislature. So it seems the same reasoning does apply.
Another difference is that this contact information does not, AFAIK, include recipient-paid [1] contact methods such as mobile phone (including text) and e-mail. Also, methods such as phone are generally considered far more intrusive that, for example, paper mail.
[1] nowadays this is mosty nominal, but we're not quite at zero
Not true. Many people don't realize the value of what they have. And/or they won't see a message because of spam etc (could argue that this happens with whois also but generally the more clues the better).
Note that with physical real estate it is often purchased by someone wanting a property that has no sale sign. Also (per my other comment) there are many people who don't know the value of what they have.
So it's not a signal at all in many cases (I have over 2 decades of first hand knowledge of this btw.)
Besides it all comes down to price. You may not want to sell your house but if someone comes to offer you 3x what you paid you might listen to them. You may 'not want to sell' for what the market price is. Selling prices for domains are all over the map.
Those who buy and sell domains are another group who are annoyed that it is no longer public. They can easily solve the sell-side issue but when they want to buy a domain, if the owner is not specifically trying to sell it then it becomes more difficult to get ahold of them to make an offer.
However I will add something else.
If it becomes hard for people/companies/startups who want to buy domains (.com as you know is all that typically counts) (or for brokers etc) then there will be a shift away from .com because of that frustration. Right now people start perhaps with another TLD but once they get successful they try to get .com almost always. And that supports the market price of .com
So sure the big time people (who charge 'high' prices) will make it possible to be reached. However there is another tier that either forgets to put up contact info (or it's out of date on a web page that gets spam) or does not even know they have something of value. Those owners, if they can't be reached, will miss out. And the buyers would be more likely to then go for another TLD. Hence .com in general could loose value. [1] Not overnight but will happen.
[1] I both own domains (since 90's) and help people buy domains. This is actually my big concern with 'help people buy domains'.
As for buying and selling a domain, I've commented on that in an earlier sibling thread:
> If it's important enough, I guess the registrar could be used as relay.
>But I do see your point. On the one hand, I'd suggest an optional "reach the owner" part of whois, where one could list a physical or digital address (doesn't even have to be email, I sometimes list social network presence on "about" pages as contact method for unimportant sites, to prevent spam). But on the other hand, we already have a place where you can optionally put your contact details: the very website we're talking about. And there you can apply any anti-spam measures you want, which you cannot do if it's in a public directory somewhere.
> I think it's fine if people have to publish their contact info themselves.
https://www.recordedfuture.com/whois-gdpr-icann/
The reason that security researchers have had success with using WHOIS data is twofold. The first is that many attackers, even sophisticated attackers, have had poor OPSEC (operational security) when it comes to registering domains. A surprisingly large number of attackers simply didn’t bother to take steps to hide their identity or create unique, fake aliases when registering domains. Spammers were notoriously bad at hiding their identity, making it easy to identify newly registered domains as belonging to a known spammer and immediately adding it to block lists and real-time blackhole lists (RBLs).
Secondly, even attackers who realized their mistake and changed the WHOIS information of their domains after the fact, or added privacy services to the domain, were out of luck because certain companies, such as DomainTools, keep track of historical WHOIS data, and researchers could easily see the original WHOIS information.
Think figuring out who a given prefix belongs to, what routes are advertised by an AS, what BGP communities does an AS honor, how to contact an organization's NOC ...
(yes, whois is for more than just domain names)
There are a bunch of people in this thread claiming that "WHOIS ... won't be missed" or "nobody uses WHOIS properly these days", and it just gives me the impression that a) they operate delinquent, abusive domains for which they receive calls or b) they think that because they haven't used WHOIS productively, they never will. You'll miss opiates when you're in pain.
Neither of those are the registrant's private information. I don't understand why we're pushing to have private data in a public directory in the first place. (I never understood this, but being young, I first registered a domain around 2008, long after it was common to ring Joe from USAF up because their FTP was down.) The registrar has to store it for billing anyway, so if a domain is used for something illegal, the police can get at the info anyway...