How to Stop Your Domain From Expiring by Accident
Most lost domains were not stolen or forgotten. They lapsed through an expired card, a departed employee's inbox or a stale contact record. Here is how to close those gaps and what to do if one slips through.
How accidental expiry actually happens
The failure is nearly always administrative. The common chains look like this:
- A dead payment method. Auto-renew is switched on, but the card on file expired, was replaced after a fraud alert, or belongs to someone who left. The charge fails and the registrar's only warning goes to an inbox nobody reads.
- Notices to an ex-employee. The registration was made years ago by a developer or agency. Renewal reminders still go to their address, which was deleted with their account.
- Stale contact data. The registrant email lists a domain you no longer own, often the very domain that is expiring, so reminders cannot arrive.
- Registered by a third party. A web agency or hosting company registered the name in its own account. When the contract ends, so does their interest in paying.
- Assuming hosting includes the domain. The site is hosted by one company and the registration sits somewhere else. Cancelling the hosting plan does not renew a domain.
- Quietly ignored reminders. Renewal emails look like marketing and get filtered. Meanwhile, fake invoices make people distrust real ones.
A domain that lapses is not instantly lost, but its website and email usually stop working within days, and each subsequent stage costs more and carries more risk of someone else getting the name.
Build layers, not one safeguard
Turn on auto-renew and verify it works
Auto-renew is the first line, not the whole defence. Check that the payment method is current, that the billing email is monitored, and that the setting is actually on for each domain, since some registrars turn it off after a manual transfer or a failed payment. A second, backup payment method removes a single point of failure where the registrar supports it.
Renew for several years
Registrations can generally be extended to multiple years at once, up to a maximum of ten years in total for gTLDs (ICANN's base registry agreement caps both initial registrations and renewals at ten years from the date of the renewal; country-code registries set their own limits). A longer term shrinks the number of renewal events that can go wrong, and for valuable names it removes most of the risk. The cost is cash tied up in advance and, at some registrars, price changes you could have avoided by waiting. For a domain your business depends on, the trade is usually worth it.
Use role-based contacts
Set the registrant, admin and billing contacts to role mailboxes such as domains@ your company address, delivered to at least two people. Do not use an address on the domain itself as the only contact. If the domain lapses, the notices go nowhere. Include one address at a different domain, ideally on an independent provider.
Lock the domain at the registrar
A registrar lock sets clientTransferProhibited, which blocks transfers to another registrar without your approval. It protects against hijacking, not against expiry, but it also stops an unauthorised party moving the domain while it is in a vulnerable state. Valuable domains can add a registry lock, which requires verification outside the normal login. Enable two-factor authentication on the registrar account, because the account is the real key to the domain.
Keep registrar and DNS separate on purpose
Holding registration at one company and DNS at another is fine, but write down where each lives. Many outages after a lapse come from the team not knowing which login controls what. For the DNS side, see DNS nameservers and providers.
Be careful with transfers near expiry
Moving a domain to a new registrar in its final days is risky. The transfer needs an authorization code, may need approval from the old registrar, and can take up to several days; a delay can run the clock past expiry. Rules also vary depending on whether the name has entered a grace period. A transfer normally adds a year to the registration, but it is not safe to assume it will always be processed in time. Renew first, then transfer after the new date is confirmed, unless your registrar explicitly says otherwise. Also note that registrars may refuse to transfer a name within 60 days of its creation or of a previous transfer (ICANN's Transfer Policy allows this, and many registrars apply it by default). ICANN's Board adopted revised Transfer Policy recommendations in June 2026, including a proposed single 30-day restriction, but we found no effective date, so plan around 60 days.
Why lapsed names get caught by someone else
When a registration ends, it passes through grace, redemption and pending delete stages that the domain lifecycle guide covers in detail. If it finally drops, specialist services and individual speculators race to register it the moment it is released. Names with traffic, backlinks or brand value are targeted, and a former owner can find the domain reregistered within seconds, redirected to an unrelated site, or offered back at a high price. The mechanics are described in drop catching and backorders. The only reliable defence is to never let it reach that stage. Once a name has dropped, your recovery options are the same as anyone else's.
If it already expired: recovery by stage
Terms vary by registry and registrar, but the pattern for generic extensions is consistent. Ask the registrar rather than assuming, and act as soon as you notice.
| Stage | Typical state | Recovery | Cost pattern |
|---|---|---|---|
| Just after expiry (auto-renew grace) | Site often parked or offline; name still held by your registrar | Renew in the control panel or by support request | Normal renewal price at most registrars, sometimes with a late fee |
| Registrar auction or hold | Some registrars list the expiring name for sale | Contact the registrar before the auction ends | Renewal price or a negotiated fee |
| Redemption (about 30 days) | Name deleted at the registry, off the zone, status redemptionPeriod | Registrar requests a restore from the registry | Restore fee plus renewal, often a large multiple of the normal price |
| Pending delete (about 5 days) | Status pendingDelete | Not recoverable by the owner | None: you can only compete to re-register after it drops |
| Released | Available to anyone | Register it, or backorder before | Registration price, or auction price if contested |
Registrars of generic TLDs are bound by ICANN's Expired Registration Recovery Policy, which requires them to send at least two renewal notices before expiry and a further notice if the name is still neither renewed nor deleted five days after expiry, and to publish their renewal, post-expiry renewal and redemption fees. Read your registrar's terms on that page before you need it.
Country-code extensions often run their own timelines, with different lengths and sometimes no redemption stage. If the name is not under a generic TLD, check the registry's published policy.
Monitoring: do not rely on the registrar's emails alone
Add independent checks so that a missed notice does not become a lapse.
- Expiry date check. Query the registration data through WHOIS or RDAP on a schedule and alert when the expiry date is less than 60 days away. A script that reads the RDAP
expirationevent is enough. - Status check. Alert if the status shows
clientHold,serverHold,redemptionPeriodorpendingDelete. - DNS check. A monitor that confirms the apex and key records resolve from outside your network catches suspended names quickly, usually before customers complain.
- Calendar entries. Put the expiry date in a shared team calendar with reminders at 90, 30 and 7 days.
- Certificate and mail. Expiring certificates and failed mail delivery are often the first visible signs of a domain problem.
Quarterly checklist
| Check | What to look for | Owner |
|---|---|---|
| Expiry dates | Every domain has at least 90 days left or an active auto-renew | Domain admin |
| Payment method | Card not expiring within 6 months; backup method present | Finance |
| Contacts | Role mailboxes, delivered to two or more people, none on the domain itself | Domain admin |
| Account access | No departed staff, two-factor enabled, recovery email current | IT |
| Locks and status | Transfer lock set, status is ok aside from intended locks | Domain admin |
| Nameservers and DNS | Delegation matches the intended provider; no leftover test records | Engineering |
| Inventory | Every name still needed, with an owner and a reason for existing | Business owner |
Governance for teams and companies
Treat domains like contracts and bank accounts. The business, not an individual, should be the registrant, and the registrar account should be held under a shared company login with two-factor authentication stored in a company password manager, never a personal address. Keep one inventory listing each domain, its registrar, its renewal date, the budget owner and what depends on it. When an employee or agency leaves, update contacts and account access the same day. When a project ends, decide deliberately whether to let the name go: a retired name that still receives mail or links can be reregistered by someone else, so redirect it or keep it for a while. For many names, consolidate registrars to reduce the number of logins, and give each critical domain a documented recovery plan.
Sources
- ICANN: Expired Registration Recovery Policy
- ICANN: 5 things registrants should know about the ERRP
- ICANN: EPP status codes
- ICANN: Transfer Policy
- ICANN base registry agreement, Specification 6 section 5 (ten-year maximum)
Frequently asked questions
How long after expiry can I still get my domain back?
For most generic extensions, there is a renewal window of up to about 45 days at the registrar's discretion, then about 30 days of redemption at a higher fee, then about 5 days of pending delete in which recovery is not possible. Registrars and country codes vary, so ask yours.
Does auto-renew guarantee my domain will not expire?
No. It depends on a valid payment method, a monitored email and the setting staying enabled. A failed charge triggers no renewal, so check payment details every quarter.
Is registering for ten years a good protection?
It reduces the number of renewal events and is sensible for key names, subject to the registry's maximum term. It does not protect against hijacking or against a dispute, so keep the lock and two-factor authentication.
Can someone else register my domain while it is in the redemption period?
No. During redemption and pending delete the name is still held at the registry and cannot be registered by others. It becomes available only after it drops, which is when backorder services try to catch it.
How can I check the expiry date of my domain?
Look it up through your registrar account or a WHOIS or RDAP query. The expiry date appears as a registry expiry or expiration event. Compare it to your records and set an alert.
Should I transfer a domain that is about to expire?
Renew it first. Transfers can take days, need an authorization code, and a delay could push the name past expiry into a more expensive recovery stage.