What happens when your company domain expires, and how to prevent it

When your company domain expires, the first thing you usually notice is that email stops arriving and the website stops loading. The registrar interrupts DNS for the name, so everything that depends on it, including mail, the website, logins and API endpoints, goes dark at once. If nobody renews it, the domain is eventually deleted and anyone can register it.

For generic top-level domains such as .com, .net and .org, the timeline is set by ICANN policy and is fairly predictable. Country-code domains (.us, .uk, .de and others) follow their own registry rules, so check the terms of your registry.

The fix is simple, but it fails in boring ways: an expired credit card, a reminder sent to a former employee, or a renewal that was "someone else's job".

The expiration timeline for generic domains

The ICANN Expired Registration Recovery Policy sets minimum rules for registrars of generic top-level domains:

1. Before expiry: the registrar must send at least 2 reminders, approximately one month and approximately one week before the expiration date.
2. After expiry: if the domain is not renewed or deleted within 5 days after expiration, the registrar must send at least one more notice with renewal instructions.
3. DNS interruption: after expiry the registrar must interrupt the DNS resolution path, so the website and email stop working. If the domain is deleted 8 or more days after expiration, DNS must be interrupted for at least the last 8 consecutive days in which it can still be renewed.
4. Redemption Grace Period: once deleted, the registry must offer a 30-day Redemption Grace Period in which the registrant can still restore the name, usually for an extra fee.

After the redemption period, ICANN's EPP status code reference describes a pendingDelete status that lasts several days before the name is purged and becomes available to anyone.

The exact number of days a registrar keeps an expired domain before deleting it varies, and renewal and redemption fees vary too. The policy requires registrars to make those fees available, so read your registrar's terms before you need them.

What breaks, and in what order

When DNS is interrupted, every service on the domain fails together:

• Email: inbound mail bounces or is delayed, and outbound mail from your domain may fail authentication checks.
• Website and customer portal: visitors see an error or a registrar parking page.
• Logins and integrations: single sign-on, password reset emails, webhooks and API callbacks that use the domain stop working.
• Certificates: renewals that rely on DNS or HTTP validation fail.

If the domain is deleted and re-registered by someone else, the risk changes. The new holder can receive email sent to your old addresses, which may include password reset messages for accounts registered with those addresses.

How to check your domains yourself

Look up the expiration date with RDAP or WHOIS:

whois example.com | grep -i -E "expir|registrar:|status"

You will see the expiration date, the registrar and the EPP status codes. Statuses such as clientTransferProhibited are normal and protective. Statuses such as redemptionPeriod or pendingDelete mean the domain has already lapsed.

Then check the registrar account itself:

• Is auto-renew enabled for every domain you rely on?
• Is the payment method valid and not expiring before the renewal date?
• Do reminder emails go to a shared mailbox that someone reads, not to a single person?
• Is the contact email itself on a different domain? If reminders go to admin@example.com and example.com has expired, they cannot arrive.

How to prevent expiration

• Turn on auto-renew and renew for several years at once for your primary domain.
• Keep an inventory of every domain you own, including old brands and campaign domains that still receive mail or redirect traffic.
• Use a role address such as domains@ for registrar contacts, and add a backup contact on another domain.
• Protect the registrar account with multi-factor authentication. A lost login can be as damaging as a lapsed payment. See unexpected nameserver or registrar changes.
• Monitor from outside. A check that reads the expiration date every day works even when the person who set up auto-renew has left.

If your domain has already expired

1. Log in to the registrar and renew immediately. During the period before deletion this is usually a normal renewal.
2. If the status is redemptionPeriod, ask the registrar to restore it. Expect a restore fee.
3. After renewal, confirm DNS is resolving again with dig example.com +short and dig MX example.com +short. Propagation can take some time.
4. Check that certificate renewals and mail delivery recovered.
5. Find out why the reminders did not reach anyone, and fix that too.

Checklist

• Expiration dates for all domains recorded in one place.
• Auto-renew on, payment method valid.
• Registrar contacts are role addresses, with a backup on another domain.
• Multi-factor authentication on the registrar account.
• An independent expiry check that alerts well before the date.

Certificates expire too, and on a much shorter cycle. Our article on SSL/TLS certificate expiration covers that side.

Where Datahorses fits

Datahorses checks the expiration date and registrar of your domains every day and sends reminders 30, 14 and 3 days before a domain or certificate expires, independent of who holds the registrar login. We watch your company from the outside, so we do not enter your systems and need no access. See what we guard and how we guard.