What happens when a domain expires?
What happens from the day a domain lapses until someone else can buy it, what stops working first, and how to make sure it never happens to you without warning.
By Javier Tenjo, Full stack developer
On this page
Domains are not bought: they are rented by the year. And almost every domain that gets lost is lost not to an attack or a legal dispute, but because the card on file expired, the renewal notice went to an inbox nobody checks any more, or the person who registered it ten years ago has left the company.
The treacherous part is that you do not see it coming. The website works normally right up to the day it stops, and by then a clock is already running that very few people know about.
Who is who in a domain
There are three parties, and they are worth telling apart because each plays a different role when something goes wrong:
- The registry runs an entire extension: Verisign operates
.com, and each country has a body for its own, such as.coor.uk. It holds the master database. - The registrar is the company you pay: a domain provider, your hosting company or your DNS provider. It deals with the registry on your behalf.
- The registrant is whoever is listed as the owner. That should be your company, not the agency that built the website or the relative who bought it on their card.
When a domain expires, the registrar decides what happens at each stage, within the registry’s rules. The timings below are therefore the usual ones for generic extensions (.com, .net, .org and the like), and it is worth confirming those for your own extension and registrar.
The life cycle of an expired domain
| Stage | Typical length | What happens |
|---|---|---|
| Expiry | Day 0 | The paid period ends |
| Grace period | Up to about 45 days | Renewable at the normal price; the website usually stops working |
| Redemption | 30 days | Recoverable only by paying a fee, often a steep one |
| Pending delete | 5 days | Can no longer be recovered |
| Released | From then on | Anyone can register it |
Grace period. The domain is still yours and renewal costs the usual amount. But during these days many registrars swap your name servers for their own and show a notice or parking page instead of your website. It is their way of making sure someone notices.
Redemption. The registry has already marked the domain for deletion. It can still be rescued, but with a recovery fee that is often several times the annual price, and the process is not instant.
Pending delete. There is no way back. When it ends the name becomes available, and domains with some history (links, traffic, age) are watched by services that exist to register them the very minute they are released.
Country-code extensions have their own rules, sometimes much shorter ones. If your domain is a .co, .co.uk or .mx, check your registrar’s terms: do not assume the timings of a .com.
What breaks first
The website, as soon as the registrar changes the name servers. But that is not the worst of it.
Email. Once the domain stops resolving, its MX records disappear and mail sent to you bounces. Clients get an error, suppliers cannot send you their invoices, and notifications from any service that uses that address stop arriving. If the renewal notice was going to an address on that very domain, you will not see it now.
Everything hanging off the domain. Application subdomains, the API, intranet access, ownership verifications in Search Console or your email platform, and the SPF, DKIM and DMARC records covered in SPF, DKIM and DMARC explained.
And if it is lost altogether, the problem changes in kind. Whoever registers it next receives the mail still being sent to your old addresses: invoices, confirmations, and password reset links for accounts created with that email. They also inherit the links pointing to your website and the traffic they bring. Recovering a domain in that situation, when it is possible at all, is slow and expensive.
WHOIS or RDAP?
For decades, looking up a domain’s details meant WHOIS: a protocol from the 1980s that returns a block of free text, formatted differently by every registry. It worked, but every tool had to guess where the expiry date sat in each response.
Its replacement is RDAP (Registration Data Access Protocol). It runs over HTTPS, returns structured JSON with the same fields everywhere, and has a standard way of finding out which server to ask about each extension. ICANN made it mandatory for generic extensions, and since 2025 their registries and registrars are no longer required to run classic WHOIS. Many country-code extensions offer it already; some do not yet.
Besides the expiry date, an RDAP record includes the domain’s statuses. A few worth recognising:
client transfer prohibited: the transfer lock. Good to have, because it stops anyone moving the domain to another registrar without your permission.auto renew period: the domain has just been renewed automatically or is in its grace period.redemption period: it is in redemption. Act now.pending delete: it is about to be released.client holdorserver hold: the domain does not resolve, because of non-payment, a dispute or a decision by the registry.
The registrant’s personal details, on the other hand, rarely appear: since the GDPR came into force in 2018, most registries hide them by default.
How to make sure it does not happen to you
None of these measures is technical or expensive:
- Auto-renewal switched on, with a valid payment method. Check the card’s expiry date whenever you change it.
- Renew for several years. Most registrars allow up to ten. A domain at the heart of the business should not depend on a single yearly charge.
- A notification contact outside the domain itself, or at least a shared address that does not depend on one person. If the notice goes to
info@yourdomain.comand the domain goes down, the notice goes down with it. - The registrar account in the company’s name, with access for at least two people and two-factor authentication. If an agency manages it, ask for your company to be the registrant and for access to be shared with you.
- Transfer lock enabled, so any change of registrar needs your authorisation.
- Your own reminder in the team calendar, a couple of months before the date. It does not replace auto-renewal: it backs it up.
If you inherit a website and do not know who manages the domain, the registrar shown in the RDAP record is the place to start: that is who you need to ask for access.
Checking yours
The domain expiration checker looks up the RDAP record of any domain and shows its expiry date with the days remaining, the registrar, the registration date, its statuses and its name servers. If fewer than 90 days are left, it flags it. If the extension does not offer RDAP, it tells you so, so you can check on the registry’s own website.
Use it on your main domains and also on the ones that depend on you without you thinking about it: the old domain that redirects to the new one, the one from a campaign years ago, the brand name you registered only to protect it. Those are usually the ones that expire without anyone noticing.
A domain is both your website’s address and your email’s. Five minutes checking auto-renewal and the notification contact is very little next to what it costs to get one back.