What happens when a domain expires

Who is involved

Three parties stand between you and your domain name. The registry operates the top-level domain, such as com or org, and holds the authoritative list of who has registered what. The registrar is the company you pay; it sends your instructions to the registry. Some people buy through a reseller, such as a web agency or hosting company, which adds a fourth party.

A registration is a rental for a fixed number of years. When the period ends, the rules for what happens next are set partly by the registry, partly by ICANN policy for generic top-level domains, and partly by the registrar's own terms. This is why details differ between registrars and why country-code domains can behave quite differently from com.

The timeline for a generic top-level domain

The stages below describe the usual sequence for domains such as com, net and org. The durations are typical values; the exact figures are in your registrar's terms.

1. Before expiry: the registrar sends renewal reminders to the contact address on the registration.
2. Expiry date: the registration period ends. The domain usually stays in your account.
3. Grace period, commonly up to around thirty days and sometimes as long as forty-five: you can renew at the normal price. At some point in this period the registrar stops the domain from resolving.
4. Redemption period, thirty days: the registrar has deleted the registration. Only the former registrant can restore it, through the same registrar, for an additional fee.
5. Pending delete, five days: nothing can be done. The registry is about to release the name.
6. Release: the domain becomes available to anyone, and is often registered again within seconds.

Day 0        Registration expires
Day 1-30     Grace period: renew at normal price; DNS is switched off during this time
Day 31-60    Redemption period: restore possible, at a higher fee
Day 61-65    Pending delete: no recovery
Day 66       Released for registration by anyone

What stops working, and when

The expiry date itself often passes without visible effect, which is part of the danger. The break comes when the registrar changes the domain's nameservers to its own or removes them, which may be on the expiry date or days later. From that moment the website shows a parking or renewal page, or nothing, and email stops arriving.

Under ICANN's rules for generic top-level domains, if the registrar offers a renewal grace period it must interrupt the domain's normal resolution for a period before it deletes the registration. The intention is that someone notices. The effect is an outage of everything that depends on the name.

1. The website and every subdomain stop resolving or show the registrar's page.
2. Inbound email fails. Senders receive bounces, or their servers retry for a few days and then give up.
3. Certificates cannot be renewed, because domain validation fails.
4. Services that verify the domain through DNS, such as single sign-on and email platforms, begin to report errors.
5. Anything using the domain's nameservers for other domains fails as well.

Why renewal notices are missed

Registrars are required to send notices before a domain expires, and they do. The problem is where the notices go. They are sent to the registrant contact address, and that address is very often one of the following.

1. A former employee's mailbox, or the personal address of whoever registered the domain years ago.
2. An address at the domain itself, which stops receiving mail the moment the domain stops resolving.
3. A shared mailbox that nobody reads, full of marketing mail from the same registrar.
4. The address of a web agency or freelancer the organisation no longer works with.
5. A privacy-service forwarding address that silently stopped forwarding.

Why auto-renew is not a guarantee

Auto-renew prevents most lapses, and it still fails in a few ordinary ways. The card on file has expired or been replaced. The bank declines an unfamiliar annual charge. The account is funded by prepaid credit that has run out. The domain was transferred into a new account where auto-renew is off by default. In each case the registrar sends a failure notice to the same contact address that nobody reads.

Treat auto-renew as the main line of defence and add a second one that does not depend on the registrar's emails.

Recovering during the grace period

If the domain has expired recently, renewal through the registrar account is normally all that is needed, at the usual price or with a modest late fee. The registrar restores the original nameservers, and the domain begins resolving again as caches refresh, typically within an hour and occasionally longer.

Renew for more than one year while you are there, fix the payment method, and correct the contact address. Then check that mail and the website actually returned. If records were hosted on the registrar's own DNS, confirm they are all still present.

dig example.com NS +short
dig example.com A +short
dig example.com MX +short

Recovering during the redemption period

Once the registration has been deleted, the domain enters redemption. It can still be restored, only by the registrant it belonged to and only through the registrar that held it. The registry charges a restoration fee, which the registrar passes on with its own margin on top of the renewal price, so the cost is many times that of a normal renewal. Restoration can also take a day or more to process.

Contact the registrar's support directly and state that you want to restore a domain in redemption. Be prepared to prove that you are the registrant, which is difficult if the contact details on the registration are out of date. This is the stage at which outdated contact information changes from an inconvenience to a real obstacle.

After release

When a domain is released, it does not sit quietly waiting. Expiring names with any history of traffic or inbound links are watched by companies that register them the moment they become available, either to resell or to use. Getting the name back then means negotiating a purchase, with no obligation on the new holder to sell.

The security consequences are more serious than the cost. Whoever registers the name controls its mail. They can receive messages still being sent to old addresses, including password reset links for any account registered with an address at that domain. They can serve content at addresses that other sites still link to, and that old documents, apps and integrations still call. An organisation that drops a domain deliberately should first move every account away from addresses on it.

Country-code domains are different

The timeline above applies to generic top-level domains. Country-code domains are run under each registry's own rules. Some have no grace period at all and delete a domain on or shortly after the expiry date. Some have a quarantine period with a different length or different conditions. Some require the registrant to be resident or established in the country, which complicates restoration. If you hold country-code domains, read the registry's lifecycle policy rather than assuming the generic one.

Preventing it

Every step here is cheap compared with a single day of the domain being offline.

1. Turn on auto-renew for every domain, and check it again after any transfer.
2. Keep a current payment card on the account and a second one as backup where the registrar allows it.
3. Renew important domains for several years at a time.
4. Set the registrant email to a monitored role address at a different domain from the one being registered.
5. Hold all domains in one registrar account owned by the organisation, not by an individual or a supplier, protected with two-factor authentication.
6. Enable the registrar lock to prevent unauthorised transfers.
7. Keep a list of every domain with its registrar, expiry date and owner, including campaign and redirect domains.
8. Monitor the expiry date independently, with warnings at sixty, thirty and seven days.

Checking the expiry date yourself

The expiry date is public for most top-level domains through the registration data service, which replaced the older WHOIS protocol for generic domains. Registrar dashboards show it too, but a lookup from outside confirms what the registry actually holds, which matters when a domain is managed by a supplier and you want to verify it independently.

Note the difference between two dates that are sometimes both shown. The registry expiry date is the one that counts. A registrar may display a different date for its own billing period.

whois example.com | grep -i -E 'expir|registrar:|status'

Registry Expiry Date: 2027-08-13T04:00:00Z
Registrar: Example Registrar, Inc.
Domain Status: clientTransferProhibited

Where monitoring fits

The lapse of a registration is the most damaging and the most predictable domain failure: the date is known years ahead. Monitoring adds a warning that does not pass through the registrar's contact address, and it notices the related signs, such as nameservers changing unexpectedly. CloudSpex watches the public state of a domain on a schedule, including its nameservers and DNS resolution, and alerts when they change. It cannot renew a domain or see inside a registrar account, so the list of who can log in and pay remains yours to keep.