Back to Checks
aws

Route 53 domain has admin contact privacy protection enabled

route53_domains_privacy_protection_enabled
Service: route53Severity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

Route 53 domain administrative contact has privacy protection enabled, so WHOIS queries return redacted or proxy details.

Evaluates whether contact data is hidden instead of publicly listed.

Prowler logoProwlerprowler-provider-aws

Risk

Public WHOIS contact data exposes names, emails, phones, and addresses, enabling:

  • Phishing/social engineering of the registrar
  • SIM-swap or account takeover
  • Domain hijacking, affecting DNS integrity/availability It also increases spam and targeted harassment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks route53_domains_privacy_protection_enabled

Recommendation

Enable WHOIS privacy for all contacts (admin, registrant, tech) to minimize exposure. Apply defense in depth: use dedicated, monitored contact emails, enforce transfer lock and MFA on registrar access, and regularly review settings. If a TLD lacks privacy, provide minimal, role-based contact details.

Remediation

CLI

aws route53domains update-domain-contact-privacy --domain-name <DOMAIN_NAME> --admin-privacy

Terraform

resource "aws_route53domains_registered_domain" "<example_resource_name>" {
  domain_name   = "<example_resource_name>"
  admin_privacy = true # Critical: enables admin contact privacy to pass the check
}

Other

1Open the AWS Console and go to Route 53
2Click Registered domains and select <DOMAIN_NAME>
3Click Edit in Contact information
4Enable Privacy protection (ensures Admin contact privacy is on)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.route53.route53domains_client import (
    route53domains_client,
)


class route53_domains_privacy_protection_enabled(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        for domain in route53domains_client.domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            if domain.admin_privacy:
                report.status = "PASS"
                report.status_extended = (
                    f"Contact information is private for the {domain.name} domain."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Contact information is public for the {domain.name} domain."
                )

            findings.append(report)

        return findings

References