Domain expiry and RDAP: how to stop a client domain lapsing

How a domain expires

Every registration has an expiry date held by the registry (for example the operator of .com) and managed by the registrar the owner bought it from. When the date passes without a renewal, things happen in stages, and the exact stages and lengths vary by registrar and by top-level domain:

1. The date passes. The registrar may keep the name working for a while (a grace period), or may switch the DNS to a parking page straight away.
2. The name stops resolving or is parked. The website and email stop. Many registrars point the domain at an advertising page.
3. A redemption period. For many generic domains the registry offers a redemption grace period in which the owner can still recover the name, usually at a higher fee.
4. Deletion. The name returns to the pool and anyone can register it.

You cannot read the stage from outside with certainty. What you can read is the date and the registry’s status codes, and act well before step 1.

What registrars must tell the owner

ICANN’s Expired Registration Recovery Policy applies to generic top-level domains. It requires the registrar to notify the registered name holder at least twice before expiry, about one month and about one week before, and to send another notice within five days after expiry if the name was not renewed. Notice the weak point: the notices go to the registrant contact on file. On a client site that is often the developer who registered it in 2019, a personal address, or an agency mailbox nobody reads. The reminder system works; its recipient does not.

Country-code domains (.ro, .uk, .de and others) follow their own registry’s rules, so check the registry’s page for the domain you manage.

Reading the expiry date: from WHOIS to RDAP

For years the way to see an expiry date was WHOIS, a plain-text service with no common format. Registries and registrars now offer RDAP, the Registration Data Access Protocol. It answers queries over HTTPS with JSON, so a program can read it without guessing the text layout. ICANN announced that from 28 January 2025 the Registration Data Access Protocol (RDAP) is the definitive source for generic top-level domain registration data, in place of sunsetted WHOIS services.

RFC 9083 defines the response. A domain object has an events array. Each event has an eventAction and an eventDate in RFC 3339 format. The action expiration marks the date the object will be removed from the registry at a predetermined time:

"events": [
  { "eventAction": "registration", "eventDate": "2019-04-02T10:11:12Z" },
  { "eventAction": "expiration",   "eventDate": "2027-04-02T10:11:12Z" },
  { "eventAction": "last changed", "eventDate": "2026-03-30T08:00:00Z" }
]

Two things to know before you automate it:

• Not every registry publishes an expiration event. Some country-code registries do not expose it, or do not offer RDAP at all. A tool should treat “no date” as unknown, never as fine.
• The date is the registry’s date, not a promise. A name can be renewed at the registrar a moment before the registry shows it. Treat a date a few days away as urgent regardless.

A routine for every client domain

1. Inventory. List every domain you look after, including old campaign domains, redirect-only domains and the domains used only for email.
2. Write down who owns it. Registrar, account holder, billing contact and the person who gets reminders. For each client, make sure the registrant email is a mailbox the client will still read in three years.
3. Turn on auto-renew, and check the card. Auto-renew fails quietly when the card on file expires. Put the card’s expiry date in the inventory too.
4. Consider a multi-year term for important names, if the client agrees to pay for it.
5. Lock the domain at the registrar (transfer lock) and use two-factor authentication on the registrar account.
6. Monitor the date from outside. Alert at 60, 30, 14 and 7 days. Send the alert to a person, not to a shared inbox.
7. Test the recovery path once. Know who can log in to the registrar and whether the client has to approve a payment.

If a domain has already lapsed

• Do not wait for the site to come back by itself. Contact the registrar first, because renewing before deletion is almost always possible and cheaper than any alternative.
• Ask what stage the name is in: grace, redemption or pending deletion. The fee and the deadline depend on it.
• Expect DNS and certificates to need attention afterwards. Parking pages change DNS records, and email may have bounced for days.
• Tell the client plainly what happened and what changes so it does not happen again.

Common traps

• The domain is registered in an employee’s or developer’s own name. When that person leaves, the client cannot prove ownership.
• Reminders go to a role address on the domain itself. If the domain expires, that mailbox expires with it.
• Transfers between registrars reset habits. After a transfer, auto-renew is often off by default.
• Privacy or proxy services hide the contact. Renewal notices still need to reach someone. Check where they go.

Questions

Sources

Read on 26 October 2026. Standards and vendor pages change; confirm the current text before you rely on it.

• RFC 9083, JSON Responses for RDAP (events, including expiration) (www.rfc-editor.org)
• ICANN, Expired Registration Recovery Policy (www.icann.org)
• ICANN, Launching RDAP; Sunsetting WHOIS (www.icann.org)