--- title: "How to Find All Domains Registered to an Email Address" slug: "/resources/tutorial/how-to-find-all-domains-registered-to-an-email-address" description: "Find domains linked to an email using reverse WHOIS. Learn how investigators and teams use WhoisFreaks API to map ownership fast." --- # How to Find All Domains Registered to an Email Address Written By [Qasim](https://pk.linkedin.com/in/qasimleoo), WhoisFreaks Team Published: May 22, 2026, Last Updated: May 22, 2026 ## Introduction Every domain registration leaves a trace, most importantly owner/registrant details like the contact email in the WHOIS record. Reverse WHOIS lookup by email leverages this by allowing you to input an email address and uncover all domains linked to it. What starts as a single domain can quickly expand into a broader network of related assets controlled by the same individual, organization, or threat actor. This technique is widely used in cybersecurity, OSINT, brand protection, and business research. It helps identify phishing infrastructure, detect fraud, map competitor domain portfolios, and perform due diligence on partners or suppliers, making it a powerful and accessible tool even for non-technical users. #### In this post, you will learn: * What reverse WHOIS email lookup is and how it works * What data it returns and where you can lookup that data * How to find all domains registered to an email address step by step ## What Is Reverse WHOIS Email Lookup? Reverse WHOIS email lookup is the process of querying a WHOIS database using an email address as the search input instead of a domain name; and retrieving all domain names that have been registered using that email address as the registrant contact. This technique helps identify all domains linked to specific WHOIS record details, which is especially useful for purposes such as cybercrime investigation and market analysis. To understand why this is powerful, it helps to first understand how standard WHOIS works. When a domain is registered, the registrant provides personal or organizational contact information; name, email, phone, address, and organization; which is stored in a publicly accessible WHOIS record. Standard WHOIS lookup lets you query this data by domain name: enter [example.com](http://example.com) and see who registered it. For a complete lookup of any domain name, you can try [WHOIS lookup tool](https://whoisfreaks.com/tools/whois/lookup). Reverse WHOIS inverts this relationship entirely. Instead of asking _"who owns this domain?"_, you ask _"what domains does this person or email own?"_ The result is a complete list of every domain name in the WHOIS database that has ever been associated with the queried email address; across all TLDs and registrars, historically and currently. Reverse WHOIS searches rely on indexed databases containing billions of current and historical domain registration records. A single email address can be connected to hundreds or even thousands of domains registrations, making reverse WHOIS email lookup an exceptionally efficient way to map the full digital footprint of any registrant. ## What Data Does Reverse WHOIS Email Lookup Return? When you perform a reverse WHOIS lookup by email, you receive a list of domain records; each containing the full WHOIS registration details for that domain. Here is what each record typically includes: | Field | Description | | --- | --- | | Domain Name | The domain registered using the queried email | | Query Time | The time at which the domain was queried for live WHOIS | | Creation Date | When the domain was first registered | | Updated Date | Last modification to the WHOIS record | | Expiry Date | When the domain registration expires | | Name Servers | The NS records associated with the domain name | | Domain Status | The Domain status(es) of domain when it was queried | | **Registrar Details** | | | Name | The registrar through which the domain was registered | | IANA ID | The unique identifier assigned to the registrar by IANA | | WHOIS server | The WHOIS server address provided by the registrar | | Website URL | The official website of the registrar | | **Registrant/Owner, Billing, Technical, and Admin Details** | | | Name | Name associated with the registration | | Company | Organization/Company name if applicable | | Email | The queried email address (confirmed match) | | Phone/Fax | Contact phone and fax numbers of the registrant | | Mailing address | Complete address like city, state, country of the registrant | | There are some other fields too that you can see by performing a reverse lookup | | It is important to keep your WHOIS information accurate and up to date. If you need to update or correct your WHOIS information, you can do so through your domain registrar, ensuring that your contact details in the WHOIS database remain current. WHOIS Lookup reports are parsed and normalized so professionals can easily access and make sense of the information they provide. ## How to Find All Domains Registered to an Email Address: Step-by-Step Guide There are two primary ways to perform a reverse WHOIS lookup by email using WhoisFreaks; the **free web tool** and the **Reverse WHOIS API** for programmatic access. You can test the WhoisFreaks [reverse WHOIS lookup tool](https://whoisfreaks.com/tools/whois/reverse/search) to verify domain information, perform investigations, or conduct market research. ### Method 1: Using the WhoisFreaks Reverse WHOIS Lookup Tool (Free) The simplest way to find all domains registered to an email address is through the WhoisFreaks web interface, no technical knowledge required. #### Step 1: Navigate to the Tool Go to [https://whoisfreaks.com/tools/whois/reverse/lookup](https://whoisfreaks.com/tools/whois/reverse/lookup) #### Step 2: Enter the Email Address Type the email address you want to investigate into the search field: ``` dns-admin@google.com ``` #### Step 3: Select Search Type Below the search input, select/check **_Email_** to perform a reverse WHOIS lookup by email address. You can also try the reverse lookup based on other filters like a keyword, owner/registrant name or company name. #### Step 4: Select Contact type After selecting email filter, check the contact type you want to be included in response. Like if you want to get all domains where billing address contains the entered email, check the _Billing_ radio button. #### Step 5: Click Search Click **Search** to initiate the reverse WHOIS email lookup. WhoisFreaks will query its database of 7.1+ billion WHOIS records and return all domains associated with the entered email address. **Note:** You may need to sign in to access full results or advanced features. And don't worry about any payments, you get _500 Free Credits_ _on signup._ #### Step 5: Review Your Results Results are returned in a structured list showing all matched domain names along with their WHOIS details, like registrar details, creation date, expiry date, registrant details, status, etc. #### Step 6: Export Results Download the full results as CSV for further analysis. ### Method 2: Using the WhoisFreaks Reverse WHOIS API (Programmatic) For automation, integration into security platforms, or building reverse WHOIS email lookup into your own applications, the API is the right approach. **API Endpoint:** ``` GET curl --location 'https://api.whoisfreaks.com/v1.0/whois?apiKey=YOUR_API_KEY&whois=reverse&email=dns-admin@google.com&includes=billing&page=1' ``` **Key Parameters:** | Parameter | Description | Example | | --- | --- | --- | | whois | Set to reverse for reverse WHOIS | reverse | | apiKey | Your WhoisFreaks API key | YOUR_API_KEY | | email | The email address to search (allows regex like m*@gmail.com, *@google.com) | dns-admin@google.com | | includes | The domains whose WHOIS contains contact details with the specified email (admin, technical, registrant or billing) | billing | | page | Page number for paginated results (each page contains a max of 100 records) | 1 | **Sample Response Structure for above request:** ``` { "total_Result": 124, "total_Pages": 3, "current_Page": 1, "whois_domains_historical": [ { "num": 1, "status": true, "domain_name": "alphabet.markets", "query_time": "2020-04-06 11:20:18", "create_date": "2015-08-12", "expiry_date": "2020-08-12", "domain_registrar": { "iana_id": "292", "registrar_name": "markmonitor inc", "whois_server": "whois.markmonitor.com", "website_url": "http://www.markmonitor.com" }, "registrant_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "administrative_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "technical_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "billing_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "name_servers": [ "ns1.googledomains.com", "ns3.googledomains.com", "ns2.googledomains.com", "ns4.googledomains.com" ], "domain_status": [ "clientupdateprohibited", "clientdeleteprohibited", "clienttransferprohibited" ] }, { "num": 2, "status": true, "domain_name": "xn--9dblh6b.xn--9dbq2a", "query_time": "2024-09-21 13:51:14", "create_date": "2018-10-16", "update_date": "2024-09-15", "expiry_date": "2025-10-16", "domain_registrar": { "iana_id": "292", "registrar_name": "markmonitor inc", "whois_server": "whois.markmonitor.com", "website_url": "http://www.markmonitor.com" }, "registrant_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "administrative_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "technical_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "billing_contact": { "name": "Domain Administrator", "company": "Google LLC", "city": "Mountain View", "state": "CA", "zip_code": "94043", "country_name": "United States", "country_code": "US", "email_address": "dns-admin@google.com", "phone": "+16502530000", "fax": "+16502530001" }, "name_servers": [ "ns1.googledomains.com", "ns3.googledomains.com", "ns2.googledomains.com", "ns4.googledomains.com" ], "domain_status": [ "clientupdateprohibited", "clientdeleteprohibited", "clienttransferprohibited" ] }, // .. continues to 100 records ] } ``` Results are paginated with up to **100 records per page**. Always check **totalPages, total_Pages** (or any other key specifying total pages count) in the response and loop through all pages to retrieve the complete dataset. ### Method 3: Searching by Other WHOIS Attributes While email is the most common search attribute, WhoisFreaks Reverse WHOIS also supports lookup by other WHOIS fields; giving you additional pivoting options when an email alone is not enough: | Search Type | Parameter | Example Value | | --- | --- | --- | | Email | email | admin@example.com | | Owner | registrant name | elon musk | | company | Organization | google | These additional search types are powerful in cases where a threat actor uses throwaway email addresses but consistently uses the same owner's name or organization name across registrations. They also help users manage and update WHOIS information associated with their registered domains, making it easier to keep domain registration records accurate and up to date. ## Conclusion Finding all domains registered to an email address is one of the fastest and most effective techniques in domain intelligence and it starts with a single reverse WHOIS email lookup. From uncovering a threat actor's complete phishing infrastructure to mapping a competitor's domain portfolio to conducting corporate due diligence before an acquisition, the reverse WHOIS email technique consistently delivers intelligence that standard domain lookups simply cannot provide. One email address. Hundreds of domains. In seconds. With WhoisFreaks maintaining a database of 7.1+ billion WHOIS records including both current and historical data you have access to one of the deepest reverse WHOIS databases available, through a free web tool or a fully automatable REST API. The next time you encounter a suspicious domain, do not stop at the domain. Look up the email. The full picture is always bigger than it first appears. **Ready to find all domains registered to an email address?** [**Try the free Reverse WHOIS Lookup tool**](https://whoisfreaks.com/tools/whois/reverse/lookup) ## Frequently Asked Questions Explore frequently asked questions to better understand our features, functionality, and usage. ### What is reverse WHOIS email lookup? Reverse WHOIS email lookup is the process of searching a WHOIS database using an email address to retrieve all domain names that have been registered using that email. It is the inverse of standard WHOIS lookup, which takes a domain name and returns the registrant email. ### How do I find all domains registered to an email address? Use the WhoisFreaks Reverse WHOIS Lookup tool at whoisfreaks.com/tools/whois/reverse/lookup. Select "Email" as the search type, enter the email address, and click Search. For programmatic access, use the Reverse WHOIS API. ### Is reverse WHOIS email lookup free? You can get started for free with 500 API credits upon signing up at WhoisFreaks, no credit card required. The free web tool also allows limited reverse WHOIS email lookups. For higher volume queries, paid API credit plans are available. ### Why are some domains not showing up in my reverse WHOIS email search? Some domains may not appear if the registrant used WHOIS privacy protection, which replaces the real email with a proxy contact address provided by the registrar. Additionally, domains registered through certain country-code TLD (ccTLD) registries may not be included in all WHOIS databases. ### What is the difference between current and historical reverse WHOIS results? Current results show domains where the queried email is still the active registrant contact. Historical results show domains where the email was previously associated, but the WHOIS record has since been updated. Historical results are critical for investigations as they reveal domains a registrant has tried to hide. ### Can I search reverse WHOIS by name or phone instead of email? Yes. WhoisFreaks Reverse WHOIS supports searches by registrant name, organization, phone number, and email address, giving you multiple pivoting options for comprehensive investigations. ### How many domains can one email address be registered to? There is no technical limit to how many domains can be registered with a single email address. Large domain investors may have thousands of domains under a single email. Threat actors running large-scale campaigns may register hundreds of phishing domains using the same email address. ### Is reverse WHOIS affected by GDPR? Yes. Since GDPR came into effect in 2018, many registrars redact personally identifiable information; including email addresses; from publicly accessible WHOIS records for EU-based registrants. This means some domains registered after 2018 may not appear in reverse WHOIS email results due to privacy protection. However, historical records from before GDPR implementation remain accessible.