Domain expiration monitoring is the practice of watching a domain name’s expiration date, renewal settings and registry status codes from outside the registrar account, so that a missed renewal is caught by a system you control rather than discovered when the website goes dark. It is the one form of domain monitoring every organization needs, because every domain expires on a known date, and missing that date is public and often permanent.
The expired domain cases we handle rarely involve an organization that did not care about the name. They involve organizations that assumed the registrar’s reminder would arrive, that someone else had renewed, or that auto-renew was on. By the time anyone looked, the name had been deleted and caught by a professional who now wanted several thousand dollars for it. Domain expiry monitoring replaces that assumption with a fact that is checked every day.
Why registrar renewal notices fail
Registrars are required to send reminders. Under the ICANN Expired Registration Recovery Policy (ERRP, the consensus policy that sets registrar obligations around expiration), registrars must send two expiration notices, approximately one month and one week before the expiration date, and a further notice within five days after expiration if the name has been neither renewed nor deleted, according to the 2024 ERRP text published by ICANN. The policy also requires that DNS resolution be interrupted for at least the last eight consecutive days that an expired registration remains renewable, and that gTLD registries offer a Redemption Grace Period (RGP, the 30-day window after deletion during which the original registrant can still restore the name).
Three notices and eight days of downtime sound like ample warning. In practice the notices fail for a predictable reason: they go to the email address on the account, and that address is frequently the one thing nobody is reading. The employee who registered the domain left the company, or the mailbox was a personal address at a free provider. Most dangerous of all, the contact address is at the very domain that is lapsing, so the moment the registrar interrupts DNS, the reminders start bouncing. The warning system depends on the asset it is warning about.
Auto-renew fails for a parallel reason. It depends on a payment method that was valid when it was set. Corporate cards are reissued, expire, and get canceled after fraud, and a declined charge produces one more email to the same unread mailbox. The central point of this page bears repeating: the registrar’s reminders and the registrar’s auto-renew both depend on the account being correct, and expiration monitoring from outside the account checks whether the account is correct.
What to monitor
The expiration date itself is the first field. It is published in the domain’s RDAP record (RDAP, the Registration Data Access Protocol, replaced WHOIS for gTLDs; see our comparison of RDAP and WHOIS), and a monitor should read it daily and compare it to the last reading. A date that moves forward a year is a successful renewal. A date that does not move as it approaches is the alarm.
The auto-renew flag lives inside the registrar account rather than in the public record, so it must be checked there, through the registrar’s API or a quarterly review. The monitor should also read the EPP status codes (the registry-level flags that describe a domain’s state). Three of them mark the stages of a lapse. The autoRenewPeriod status means the registry has auto-renewed the name at the registrar’s expense and the registrar can still delete it for credit, which is the grace period most registrars pass on to registrants. The redemptionPeriod status means the registrar has deleted the name and it sits in the 30-day RGP, recoverable only for a restoration fee. The pendingDelete status means the RGP has ended and the name will drop within days. We walk through the full sequence in our guide to the domain expiration lifecycle.
The sponsoring registrar should never change without your knowledge, and the payment method on file should be recorded with its own expiry date, because a card that expires before the domain does is a renewal that will fail.
Designing domain expiration alerts
An alert that goes to one person once is a registrar notice with extra steps. Domain expiration alerts should escalate. A sensible schedule sends a first notice at 90 days to the domain’s internal owner, a second at 60 days to that person and their manager, a third at 30 days to the IT or security group as well, and a final notice at 7 days to everyone including an executive sponsor. Each alert should name the domain, the expiration date, the registrar and the person responsible for renewing.
Email alone is not enough, for the reasons already given. Send the alerts to several named people, to a shared mailbox monitored by role, and to a webhook (an HTTP call the monitor makes to another system) that opens a ticket or posts to a channel. Once the expiration date moves, the monitor should close the alert automatically, so the team learns to trust the alerts rather than ignore them.
Portfolio practice that prevents lapses
Monitoring works best alongside housekeeping. Keep an inventory of every domain the organization owns, with the registrar, the account owner, the expiration date, the payment method and the business purpose of each. Domains that nobody can explain are the ones that lapse. Register the names that matter for multi-year terms, because a domain that expires in 2035 cannot be lost in 2027. Put every expiration on a shared company calendar that outlives any one employee, and pay renewals with a company card held by finance rather than a personal card. Our post on the domain name registration expiration date explains how to read the date correctly.
What happens to a domain that drops
The research on the other side of the drop explains why this matters. A 2016 measurement of more than four million domains found that 10.1% of deleted .com domains are re-registered on the same day their old registration is deleted, and that over half of .org drop-day re-registrations occur within the first 30 seconds, according to Lauinger and colleagues at USENIX Security 2017. Drop-catching services submit registration requests the instant the registry releases the name.
A study that monitored 28,401,974 pending-delete .com, .net and .org names over nine months in 2017 found that only about 10% of dropped domains are caught, that dropcatchers representing just 0.03% of registrant clusters registered 60% of them, that previously malicious domains were caught about twice as often as benign ones, and that 94% of 6,838 subverted domains served malware, according to Miramirkhani and colleagues at WWW 2018. Researchers who re-registered 201 expired domains for a total of $1,464.64 received 650,737,621 requests from 5,540,379 unique IP addresses in four months, as reported by Squarcina and colleagues at IEEE Security and Privacy 2022. Whoever catches your lapsed domain inherits your visitors, your inbound email and your reputation for pocket change.
SSL certificate expiry: the companion watch
A domain and its TLS certificate (the credential a web server presents to prove its identity and enable HTTPS) expire on different schedules, and a lapsed certificate produces the same visible outcome: browsers display a warning and visitors leave. The same monitor that reads the domain’s expiration date should read the certificate’s expiry and alert on the same escalating schedule. It should also alert when a certificate for your domain is issued that you did not request, because an unexpected certificate is one of the earliest signs of a hijack.
How DNShield handles expiration monitoring
DNShield, our domain name monitoring service, reads the registration record for each monitored domain every day, tracks the expiration date and the EPP status codes, and alerts on an escalating schedule to several designated contacts and to a webhook where the client wants a ticket opened. It flags autoRenewPeriod, redemptionPeriod and pendingDelete the day they appear, watches for registrar changes, and tracks certificate expiry alongside the domain. When a name has already dropped and been caught, our expired domain name recovery service handles the restoration, the backorder or the negotiation with the new holder. We would rather send a reminder at 90 days than negotiate a buyback after the drop. Contact us to put your domains under watch.