Suppose I register a domain with a name nobody would guess, and only a friend and I ever use it. No links to it anywhere, no search engine submission.
My assumption was that it would be effectively invisible. But I gather registration involves reporting of some kind, and I do not know how much of that is public.
So realistically, who learns that this domain exists, and could it be kept genuinely private?
If the actual goal is a private service rather than a private domain, the shape of the answer changes entirely and is much more achievable.
A virtual private network, a mesh network between your two machines, or an authenticated tunnel gives you a service only the two of you can reach, with no public name and nothing published anywhere. That is genuinely private in the way you were hoping the obscure domain would be.
Worth deciding which of the two you want, because they have almost nothing in common technically.
It cannot be kept secret, and the list of parties who learn about it is longer than most people expect.
At registration: the registrar, the registry for that top-level domain, and anyone consuming the registry's zone data. Zone files for many top-level domains are made available to approved parties under a formal access programme, and there are commercial services built entirely on watching newly registered domains. Registration of a new domain is a published event, not a private transaction.
At certificate issuance: this is the one people miss. Publicly trusted certificates are recorded in certificate transparency logs, which are public, append-only and searchable by anyone. The moment you obtain a certificate for a name, that name is in a public log forever. There are free services that let you type a domain and see every certificate ever issued under it.
In use: your DNS resolver, your network operator, and any resolver in the path see the queries.
On the parts that can be reduced, since some of it is under your control:
Registration contact details are largely maskable now. Most registrars offer privacy services and several top-level domains redact personal data by default, so your name and address need not be public even though the domain's existence is.
Certificate transparency can be partly mitigated with a wildcard certificate, which puts only the parent name in the log rather than each subdomain. The parent is still logged.
Your traffic can be kept off your local network's view with encrypted name resolution, which hides queries from an observer on the path but not from the resolver you chose.
So you can control who knows who owns it and reduce who sees which names underneath it. The existence of the registration itself is public by design.
@proxy_pol · 3w ago
Worth adding what happens in practice, because it is faster than people imagine.
Register a domain, point it at a server, obtain a certificate, and within hours you will typically see automated scanners arriving. They are not targeting you — they consume the same public feeds described above and probe everything new as a matter of routine.
So the practical answer to "who would know" is: a considerable number of automated systems, essentially immediately, whether or not any human ever looks at the results.
The corollary matters for anyone putting something on an unlisted address: obscurity of the name provides no protection. A service reachable at a name nobody guessed is a service that will be found, quickly, by something. Authentication and access control are the only things doing real work.
Reply
Report