When a domain name expires, it does not disappear on the expiration date. It passes through a sequence of stages, each with its own status code, its own rules about what the registrant can still do, and its own price for doing it. The sequence begins with a registrar-controlled grace period in which renewal is routine, continues through a 30-day Redemption Grace Period in which the domain can still be restored for a higher fee, narrows to a five-day Pending Delete window in which nothing can be done, and ends with deletion from the registry, when the name is released to whoever registers it first. The whole cycle takes roughly two to three months, and this guide walks through every stage of it.
The stages below apply to gTLDs (generic top-level domains such as .com, .net and .org) under ICANN policy. Country-code domains such as .de or .co.uk follow their own rules, which are often shorter and sometimes have no redemption period.
Before expiration: the reminder notices
The lifecycle starts before the expiration date. ICANN’s Expired Registration Recovery Policy (ERRP), the consensus policy that sets minimum registrar obligations for lapsed domains, requires two expiration notices, approximately one month and one week before the expiration date, according to the ICANN Expired Registration Recovery Policy redline of 21 February 2024, which contracted parties were required to implement by 21 August 2025. If the addresses on file belong to someone who has left, or to the very domain about to lapse, the notices are never read, which is how most accidental expirations begin. At this stage the status is normally ok or clientTransferProhibited and renewal costs the ordinary annual fee.
Stage one: expiration and the auto-renew grace period
On the expiration date, the registry automatically extends the registration by one year and charges the registrar. The registrar now holds the domain in the auto-renew grace period, during which it can either collect the renewal fee from the registrant or delete the domain and receive a credit from the registry. The registry allows up to 45 days, but each registrar decides how much to pass on; some delete much sooner or move the name into an expiry auction.
The registrant sees the domain still in the account, flagged as expired, with a renew button at the standard price and sometimes a late fee. The ERRP requires a further notice within five days after expiration if the domain has been neither renewed nor deleted, and requires that DNS resolution be interrupted for at least the last eight consecutive days after expiration that the registration remains renewable, with any landing page conspicuously stating that the registration is expired. The interruption exists so that a registrant who ignored three emails notices when the website and email stop working, while the domain is still cheap to renew. Many registrars interrupt DNS almost immediately and show a parking page.
The WHOIS or RDAP record (WHOIS is the public registration record for a domain name; RDAP is its structured successor) typically shows autoRenewPeriod alongside clientTransferProhibited or clientHold. What can still be done: renew at the current registrar. What cannot be done: transfer to another registrar, which the registry rejects until the name is renewed, as explained in our guide to transferring a domain that expired three days ago.
Registrar variation: auctions and shortened grace
The auto-renew grace period is where registrar practice diverges most. Several large registrars run expiry auctions in which an expired domain is offered to bidders while it is still in the original registrant’s account. If the registrant renews before the auction closes, the auction is canceled; if not, the winning bidder receives the domain and the name never reaches the public drop. Other registrars shorten the renewable period to a few weeks. The difference between a registrar that holds a name for 40 days and one that auctions it at day 25 is the difference between an easy recovery and an expensive one, so read your registrar’s policy before a domain lapses.
Stage two: the Redemption Grace Period
When the registrar deletes the domain, the registry does not release it. It moves the name into the Redemption Grace Period (RGP), a 30-day hold during which only the sponsoring registrar can restore it, and only for the registrant of record. The ERRP requires gTLD registries to offer this 30-day period immediately following deletion.
The registrant sees the domain gone from the account or marked as deleted with a restore option. The public sees nothing working, and the registration record shows redemptionPeriod. What can still be done: restore the name through the original registrar. What it costs: a redemption fee, commonly several times the annual renewal price, plus the renewal year itself. Restoration can also require identity verification. The domain is still fully recoverable at this stage, which is the single most important fact in the lifecycle; most of the expired domains DNAccess recovers at the registrar level are recovered here.
Stage three: Pending Delete
If the 30 days pass without a restore, the registry moves the domain into Pending Delete, which lasts five days and carries the status pendingDelete. Nothing can be done by anyone, including the registrar. The only useful action is to place backorders with the drop-catching services. At the end of the five days the registry deletes the domain and it becomes available for new registration, an event the industry calls the drop.
After the drop: who catches expired domains and why
The drop is not a quiet return to the pool of available names. Drop-catching services, companies that operate large numbers of ICANN-accredited registrars for the sole purpose of registering names the instant they are deleted, fire requests the moment the registry releases a name. A 2016 measurement of more than four million domains found that 10.1% of deleted .com domains are re-registered on the same day their old registration is deleted, that drop-catch services control over 75% of accredited registrars, and that over half of .org drop-day re-registrations occur within the first 30 seconds, according to Lauinger et al., WHOIS Lost in Translation (USENIX Security 2017).
Researchers who monitored 28,401,974 pending-delete .com, .net and .org names over nine months in 2017 found that only about 10% of dropped domains are caught, that dropcatchers representing 0.03% of registrant clusters registered 60% of them, and that previously malicious domains were caught about twice as often as benign ones, according to Miramirkhani et al., Panning for gold.com (WWW 2018). The same study found that less than 11% of caught domains went on to host real web content.
The reason abusers want expired domains is residual trust: a domain that was in use for years keeps receiving email and visitors following old links long after its owner stops using it. When researchers re-registered 201 expired domains for about $7.29 each, they received 650,737,621 requests from 5,540,379 unique IP addresses over four months, with at least 50.58% of HTTP(S) clients classified as residual-trust traffic, according to Squarcina et al., Domains Do Change Their Spots (IEEE S&P 2022). Whoever catches a lapsed corporate domain inherits its inbound email and the trust of every system that still points at it, which is why a dropped domain is a security incident, and why our guide to a domain re-registered by someone else starts with finding out who caught it.
The lifecycle at a glance
| Stage | Typical duration | Status code | Recovery option |
|---|---|---|---|
| Active, approaching expiration | Reminders about one month and one week before | ok or clientTransferProhibited | Renew at the normal annual fee |
| Expired, auto-renew grace period | Up to 45 days, set by the registrar | autoRenewPeriod, often with clientHold | Renew at the current registrar; transfer is not possible until renewed |
| Redemption Grace Period | 30 days after deletion | redemptionPeriod | Restore through the original registrar for a redemption fee plus renewal |
| Pending Delete | 5 days | pendingDelete | None; place backorders with drop-catching services |
| Released (the drop) | Immediate | Not registered, or a new registrar and creation date | Register if free, win the catcher’s auction, or negotiate with the new registrant |
How to read status codes to know where a domain is
A registration lookup returns one or more EPP status codes (EPP is the Extensible Provisioning Protocol, the language registrars and registries use to manage domains), and reading them tells you the stage. A domain showing ok, or the protective locks clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited, is active and healthy. autoRenewPeriod means the domain is in the registrar’s grace period, and clientHold alongside it usually means DNS has been suspended. redemptionPeriod means the registrar has deleted the name and the 30-day restore window is running. pendingDelete means the restore window has closed and the name will be released within five days. pendingRestore means a restore has been requested and the registrar has a short window to complete it.
Two dates complement the status. The expiration date may already have advanced a year because of the registry’s automatic extension, which does not mean the registrant renewed. The creation date reveals a drop: if a domain you once held now shows a creation date after your expiration, it has been re-registered by someone else. Our post on the domain name registration expiration date explains how to find these fields at any registrar.
What DNAccess does
DNAccess recovers expired domain names at every stage of this lifecycle: regaining account access and renewing during the grace period, restoring names during the Redemption Grace Period, placing backorders and bidding at auction around the drop, and negotiating with or disputing against a new registrant once a name has been caught, as described on our expired domain name recovery service page. The better outcome is never reaching stage two. DNShield domain name monitoring checks each domain’s expiration date and status codes daily and alerts you when a renewal fails, and our guide to domain expiration monitoring explains how to set that up for a portfolio. If a domain of yours is already in this lifecycle, contact DNAccess with the name and we will tell you where it is and what it will take to get it back.