Domain Expiry. How Not to Lose Your Business

How domain expiry actually works

Every registered domain has an expiration date set at registration and extended each time you renew. The registrar bills you (usually via stored credit card) on or before that date. If payment succeeds, the expiration is pushed out another year (or however long you renew for). If payment fails, the domain enters a series of states with increasingly costly recovery:

1. Active, domain works normally, expires in N days.
2. Expired (Grace Period), typically ~30 days. The domain stops resolving (in most cases). You can renew at the normal price.
3. Redemption Grace Period (RGP), typically ~30 more days. The domain is held but recoverable. Renewal costs ~$80–200 depending on the TLD, on top of the normal renewal fee.
4. Pending Delete, 5 days. The domain is locked and headed for deletion. Most registrars won't accept renewal here.
5. Released, the domain returns to the registry pool. Anyone can register it. Drop-catching services aggressively snipe expiring domains, sometimes within milliseconds of release.

Why auto-renew is not a complete solution

The failure modes that hit real businesses:

• Stored card expired. Your card on file expired 4 months ago. The registrar tried to charge, failed, sent an email, to an address you no longer monitor, or that ended up in spam.
• Registrar account locked. Login attempts from a new country, suspicious activity flag, password reset email never seen. Auto-renew can't run on a locked account.
• The registrar itself has a billing glitch. Specific to your account. Their system thinks you canceled. Or they migrated billing systems and your auto-renew didn't migrate.
• Domain transferred to a new registrar without auto-renew re-enabled. Default settings vary by registrar.
• The person who registered the domain left. The notification emails go to their old work address. Nobody else knows the renewal is coming.
• The credit card was flagged for fraud. Sometimes registrar charges hit fraud filters because the merchant code or amount is unusual.

The cautionary tales

Domain expiration outages happen to companies you'd think would never let it happen:

• Microsoft let hotmail.co.uk expire in 2003, someone re-registered it briefly.
• Foursquare's domain expired in 2010, they were down for hours.
• Regions Bank's bank-of-america-customer-service.com expired and was scooped by a phishing operation.
• Various YC and venture-funded startups have all lost domains to expiration.

The common thread: every single one had auto-renew enabled. The auto-renew failed silently.

What a good expiry monitor actually checks

• Direct query of WHOIS/RDAP against the authoritative TLD registry, not just your registrar's API.
• Compare against a configurable threshold. 60-day warning, 30-day alert, 14-day critical.
• Track historical expiry, so an unexpected change (e.g. someone shortened the registration by mistake) is visible.
• Verify the registrar matches expectation, if your domain suddenly shows a different registrar than you set, that's a transfer in progress.

RDAP vs WHOIS

WHOIS is the old protocol: text-based, unstandardized, every TLD returns differently shaped data. Parsing dates reliably across all TLDs is genuinely hard.

RDAP (Registration Data Access Protocol, RFC 7480-7484) is the JSON-based modern replacement. ICANN's RDAP transition began in 2017; most major TLDs now have RDAP servers. The schema is standardized, events array with eventAction: "expiration" is universal.

DomainsDoc tries RDAP first (faster, structured), falls back to WHOIS for TLDs without RDAP support yet. Either way you get a reliable expiry date.

Beyond monitoring: protecting yourself

• 10-year registrations are available at most registrars. The cost is trivial vs. the risk of expiry. Renew for 10 years on critical domains.
• Multiple payment methods on file. Some registrars let you set a primary and backup card. Use both.
• Notification email to a group address, not a personal email. If billing@yourcompany.com goes to three people, all three see the renewal alert.
• Registrar transfer lock enabled. Prevents social-engineered transfer attempts.
• Two-factor on the registrar account. Hardware key if possible. Domain hijack is a real attack and costs the same as bankruptcy.
• Independent monitoring via a service that has no shared failure modes with your registrar.

How DomainsDoc handles it

We query RDAP (or WHOIS as fallback) every 24 hours for each domain you monitor. We cache the result to be polite to the registrar systems, you don't get bursty traffic. We alert at:

• 60 days remaining (warning), gives you time to check auto-renew is actually working.
• 30 days remaining (critical), manual renewal required if auto-renew has failed.
• Any change in registrar, possible unauthorized transfer.
• Any time the expiry date moves backwards, likely an account issue.

One less thing to remember. One less catastrophic risk.