What happens when a domain expires: the timeline from the date to the drop

The date is not the cliff

A domain's expiry date is the day your claim on the name stops being certain, not the day the name is gone. What follows is a sequence of states with names of their own, each with a price and a way back, until the last one, which has neither. For the generic top-level domains (.com, .net, .org and the newer ones) registry rules and ICANN policy make the sequence nearly the same everywhere. Country-code domains (.uk, .de, .io and the rest) each have their own rules; assume the way back is shorter.

Expiry day

On the date, one of two things happens. If auto-renew is on and the payment works, the term extends by a year. If it does not, the domain enters the registrar's renewal grace. On .com, .net and most generic domains the registry has already extended the term on the registrar's account: the registrar has up to 45 days to renew for real or hand the name back for a credit.

ICANN's Expired Registration Recovery Policy requires the registrar to have warned the registrant twice before the date, about a month and about a week before, and once more within five days after. It also requires the registrar to interrupt the name's DNS for at least the last eight consecutive days on which the registrant can still renew, so that an expired domain visibly breaks while there is still a way back. In practice that is the parking page: the registrar swaps the nameservers for its own.

The renewal grace: up to 45 days

During the grace the registrant can still renew, usually at the ordinary price, from the registrar's control panel. How long it lasts is up to the registrar: the registry allows up to 45 days on most generic domains, and registrars pass on some or all of it. Most park the site early, because the policy says the outage has to happen.

The status the registry publishes during this time is auto renew period, and its expiry date may already read a year ahead, because the registry extended the term when it billed the registrar. That date is not yours until the registrar has been paid. Read the status, not only the date.

Redemption: 30 days at a premium

When the registrar gives up on the name it deletes it at the registry, and the domain enters the redemption period: 30 days on generic domains, status redemption period. The name no longer resolves at all. It can still be restored, only through the registrar that held it, for a restore fee the registry charges the registrar and the registrar passes on with a margin. The price varies by registrar; typically it is many times a year's renewal.

Pending delete and the drop

After redemption the domain spends five days as pending delete. Nobody can restore it now. At the end of the five days it is released and anyone can register it. Names with any traffic or history are watched by drop-catching services that request them the instant they are free, so a domain that gets this far should be assumed gone.

What breaks, and in what order

Mail breaks first, and it breaks for other people. Once the nameservers are swapped for the registrar's parking servers the domain has no MX record. A sending server that finds no MX falls back to the domain's address record, connects to the parking web server, and is refused. It typically retries for a few days, then bounces the message to its sender. You see none of this: the bounces go to your customers and suppliers, and the first you hear is a phone call. Mail you send suffers too: receivers find no SPF or DKIM records at the parking nameservers and treat it as unauthenticated, which the large mailbox providers junk or refuse.

The site breaks second, and it breaks slowly. Resolvers that cached your records keep answering with them until the TTL runs out, so some visitors see the site for hours after the swap and others the parking page. An uptime monitor that only wants a response misses this: the parking page answers with a page. One that wants a keyword of yours does not.

Then everything that hangs off the name: the VPN gateway, the internal tools, the API your customers integrate with, the sign-in mail for every service that knows your staff by their address. Certificate renewal goes too: an automated certificate proves control of the name over HTTP or DNS, and cannot while someone else's nameservers answer, so the certificate expires next. After the drop, the new holder can put up whatever they like and receive whatever mail still arrives.

Registrar lock and the nameserver alert

Two other things take a domain away without waiting for the date.

A transfer moves the domain to another registrar. A legitimate transfer needs the domain unlocked and an authorisation code from the current registrar. The registrar lock is the status client transfer prohibited in the registry's record; while it is set, a transfer request is refused at the registry regardless of who asks. Leave it on, and check that it is on: the domain expiry checker and the monitor page both print the status codes.

A nameserver change is what a hijack looks like from outside, and what parking looks like too: either way, servers you did not choose now answer for the name. hostnag reads the registrar, the nameservers and the DNSSEC state on every poll and raises a Changed alert the moment any of them differs from the last poll, with the old and new values in it, separate from the expiry countdown. A new registrar you did not ask for, or DNSSEC switched off, gets the same treatment.

RDAP versus WHOIS

WHOIS is the old lookup: a plain-text answer on port 43, in a format each registry and registrar chose for itself, rate limited and, since privacy law, mostly empty of contacts. In January 2025 ICANN stopped requiring most generic-domain registries and registrars to run a WHOIS service at all.

RDAP is its replacement: the same registration data as JSON over HTTPS, in one format set by the IETF (RFC 9083), with a bootstrap file at IANA that names the server for every top-level domain. The expiry date is an expiration event, the registrar an entity with the registrar role, the nameservers and DNSSEC flag fields of their own.

hostnag reads RDAP only. It looks the top-level domain up in the IANA bootstrap, asks that registry for the domain, and takes the expiry, registrar, nameservers, status codes and DNSSEC state from the answer. A top-level domain with no RDAP server yet (some country codes) is reported as not checkable rather than guessed at.

Why a calendar entry fails

Most lapsed domains had a reminder. It failed one of these ways.

The reminder was addressed to a person. The person left, or the mailbox was at the domain itself and stopped working at the moment it mattered. The registrar's notices went to a registrant contact chosen years ago.

Auto-renew was on and the card had expired; the registrar tried, failed, mailed the address above, and started the grace.

The date moved. A transfer adds a year; a renewal adds one or more; a registry's auto-renew shows a date nobody has paid for. The calendar entry did not move with it.

The reminder fired once, on a busy day, and never again.

What works is a reading, not a reminder: something that looks up the real date on its own schedule, tells several people, and repeats. hostnag's alert policy defaults to 30, 14, 7, 3, 1 days before the date and repeats daily inside the last window, per group, so everyone on the group's channels is told, and told again. It reads the registry at least once a day on every plan (1440 minutes on Free), and as often as every 60 minutes on Pro and every 15 on Business, so a moved date or a swapped nameserver shows up on the next poll, not at the next anniversary.

Check one by hand

RDAP is plain HTTPS, so curl reads it; rdap.org is a public redirector that sends you on to the registry's own server.

curl -sL https://rdap.org/domain/example.com \
  | jq '{status, events, nameservers: [.nameservers[]?.ldhName], dnssec: .secureDNS.delegationSigned}'

Look for the expiration event's date, the status list (client transfer prohibited is the lock; the stages above appear under their own names) and the nameservers you expect.

Check it now, then watch it

Check it now: paste a domain into the domain expiry checker to see its registrar, nameservers, DNSSEC state, status codes and days left, read from RDAP, with no account.

Watch it for good: domain monitoring reads the registry on its schedule, climbs the ladder as the date approaches, and raises a Changed alert the moment the registrar, the nameservers or DNSSEC differ from the last poll.