Every service you run hangs from one string: the domain registration. When it lapses you do not lose one thing, you lose all of them in the same minute — the website, the email that runs the company, calendar invites, password resets, the single sign-on that gates your other tools, the API endpoints customers integrate with, and every DNS record a vendor depends on.
Almost nobody decides to let a domain expire. It happens because a card on file expired, because a renewal notice went to somebody who left two years ago, or because the agency that registered the domain for you stopped being your agency. The cost is measured in hours of downtime and, if you are unlucky, in a redemption fee to get the name back.
The lifecycle nobody reads until it matters
A domain does not switch off the moment it expires. For most generic TLDs — .com, .net, .org and the rest — it moves through a sequence of stages, each with different rules and different prices.
| Stage | What it means | Typical length | Does it resolve? |
|---|---|---|---|
| Registered | Normal operation | Until the expiry date | Yes |
| Auto-renew grace | You can still renew at the normal price | Commonly around 30 days, registrar-dependent | Usually not — the registrar parks it |
| Redemption | Recovery window, restore fee applies | 30 days for gTLDs | No |
| Pending delete | Nothing can be done | 5 days | No |
| Released | Anyone may register the name | — | Someone else's problem, and yours |
Restoring a name from redemption costs a registry restore fee on top of the renewal, and registrars add handling on top of that. It is deliberately expensive, because the alternative — letting names be recovered for free — would make expiry meaningless.
Why auto-renew fails in practice
"We have auto-renew switched on" is the most common reason given for not watching expiry dates. Here is how that promise breaks:
- The card expired. Payment cards are valid for three or four years. Domains renew every one or two. Sooner or later the renewal lands after the card has been reissued, the charge is declined, and the only notice is an email.
- The notice went to someone who left. Registrars are required to send expiry reminders roughly a month and a week before the date, and again afterwards. If those reminders land in the mailbox of a former colleague, or in a shared inbox nobody reads, the requirement has been satisfied and you still know nothing.
- The registrar account email is on the expiring domain. This is the circular failure. The domain stops resolving, so its mail stops, so the renewal notices bounce — and the password reset for the registrar account goes to the same dead address.
- Contact verification suspension. Registrars must verify the registrant's email address. Change a contact, ignore the verification link, and the domain can be suspended within about fifteen days even though it is fully paid for.
- A transfer was in flight. Moving a domain between registrars around its expiry date is a good way to end up with neither registrar renewing it.
- It is not your account. The domain sits in an agency's or a former developer's registrar account, renewed against their card. When that relationship ends, so does the renewal.
Privacy hides the date from you as well
Since GDPR, registrars and registries redact most contact fields in WHOIS and RDAP. Expiry dates are still published for gTLDs, but several country-code registries publish little or nothing, and a few show a date only to the registrant. If your portfolio includes ccTLDs, the calendar in your registrar account may be the only source — which is precisely the account you might lose access to.
What breaks without it
- The website. Immediately, for everyone, including your status page if it lives on the same domain.
- Email, in both directions. MX records stop resolving. Senders queue for a while and then bounce. Mail sent to you during the outage is not delivered late — much of it is lost.
- Single sign-on and SAML. Entity IDs and metadata URLs are domain names. When the domain stops resolving, logins to third-party tools fail even though those tools are healthy.
- Certificates. ACME validation needs working DNS or HTTP on the domain. A lapse during a renewal window turns one outage into two — see Your certificate renewed, it just never reached the server.
- Your reputation, twice over. First when visitors land on a parking page full of ads. Then, if the name is released and re-registered, when a stranger starts receiving the password-reset mail for every account your staff ever created with a company address.
How to check it in 30 seconds
Run a WHOIS / RDAP lookup against the domain. It reads the registry directly and shows the registry expiry date, the sponsoring registrar, the status codes and the name servers currently on record. From a terminal:
whois example.com | grep -iE "expiry|expiration|paid-till" dig +short NS example.com
Three things matter in that output. The expiry date — is it closer than you assumed? The status codes — clientTransferProhibited means the registrar lock is on, which is what you want between planned transfers. And the name servers — if they read something like ns1.parkingcrew.net, the domain has already lapsed and you are reading about it rather than being paged about it.
Fix it
- Renew every business-critical domain for the maximum term the registry allows, not one year at a time. Multi-year registration removes most of the failure modes above at once.
- Put the registrar account contact on a different domain from the one being registered, and use a shared mailbox rather than a person.
- Check the card on file, and set a calendar reminder for the month the card expires, not just the domain.
- Turn on the registrar lock (
clientTransferProhibited) and keep the auth code somewhere your team can reach without the domain working. - Consolidate. Domains scattered across three registrars and two agencies produce exactly the gaps described here.
- Write down who owns renewal. Not a team — a named role.
- Verify registrant contact emails when the registrar asks. An unverified contact suspends a paid domain.
Then keep it that way
A checklist you run once is a snapshot. Expiry dates move when somebody renews early, registrars change, and name servers get edited by people who do not tell you — which is the subject of Who changed that DNS record?.
Add the domain to StatusDNS and the expiry date is re-read from WHOIS/RDAP on a schedule, alongside the rest of the domain's health. You get countdown alerts at 60, 30, 14, 7, 3 and 1 days before a domain expires, and at 30, 14, 7, 3 and 1 days before a certificate does, by email, Slack or webhook. Name server changes are captured as part of the DNS snapshot diff, so a registrar swapping your NS records for parking servers shows up as a change rather than as a support ticket.
We do not renew domains for you and we never ask for registrar credentials — everything here is read from public registry data. What we do is make sure the date is never something you find out about from a customer.