Domain expiration monitoring
A domain does not expire at midnight and vanish. It goes through a sequence of stages with fixed lengths, and the price of fixing it goes up at each one until it cannot be fixed at all. Here is the whole clock, what it costs at each stage, and the five reasons the charge you assumed happened did not.
The checkup asks for a free account before it shows the report. No card, and it holds as many domains as you want to put in it.
The clock
The 30 and the 5 are ICANN registry rules and are the same everywhere for generic top-level domains. The stage before them is registrar policy and is the one that varies, which is exactly why it cannot be planned around.
| Stage | How long | Site and mail work? | Cost to fix |
|---|---|---|---|
| Registered | Until the expiry date on the registry record | Yes | The renewal price |
| Renewal grace period | Set by your registrar — often up to about 45 days, sometimes zero | Usually, then usually not | The renewal price, at first |
| Redemption Grace Period | 30 days | No | A redemption fee, well above a renewal |
| Pending Delete | 5 days | No | Nothing will work |
| Dropped | Immediately after Pending Delete | No | Whatever the next owner wants |
Until the expiry date on the registry record
The expiry date that matters is the registry's, not your registrar dashboard's cached copy. Since 28 January 2025 the definitive source for gTLD registration data is RDAP, which returns it as JSON under an event with eventAction of expiration.
Set by your registrar — often up to about 45 days, sometimes zero
This is the window nobody can quote you a number for, because it is registrar policy rather than ICANN policy. Many registrars keep the name resolving for a while, then park it on an advertising page. Some suspend DNS immediately. The name is still recoverable at the normal price here, and this is the cheap place to notice.
30 days
ICANN requires every gTLD registry to offer a 30-day redemption period after the registrar deletes the registration. During it the registry must disable DNS resolution and refuse transfers. Your website and your email are both off, and only the registrar that deleted the name can restore it, at your request, for a restore fee.
5 days
There is no action available in this window. The name cannot be renewed, restored or transferred. It is a countdown, and drop-catching services are already queued for the moment it ends.
Immediately after Pending Delete
The name returns to the pool, first come first served. If it had traffic, backlinks or a mail history, it is caught within seconds by an automated service and resold. This is how a small business ends up buying its own domain back at four figures.
Why the charge did not happen
The most common one, and the most boring. Cards expire on a three-year cycle and domains renew on a one-year cycle, so eventually the two cross. The registrar attempts the charge, it declines, and the notification of the decline goes to the same address as everything else.
ICANN's Expired Registration Recovery Policy makes registrars send a reminder roughly a month before expiry and again about a week before, plus one after expiry if the name is deleted. Every one of them goes to the registrant email on the registration record. On a domain registered six years ago that is often an ex-employee, a vendor, or a privacy-service forwarder pointing at a mailbox nobody opens.
Auto-renew is a per-domain setting, not an account setting. Bulk-registered names, transferred-in names, and names bought by somebody else and pushed into your account frequently arrive with it off. Nothing about the dashboard makes the odd one out visible.
Portfolios split. A domain bought during a rebrand sits at a different registrar, in an account under a personal email, on a personal card. Everyone assumes it is in the main account because everything else is. Nobody has checked, because checking means listing domains you do not know you own.
A registrar can suspend a name for an unverified registrant contact, a compliance issue, or a billing dispute on another product in the same account. Auto-renew is not the constraint; the account is. The clock keeps running while the ticket sits.
What good alerting looks like
A single notification at 30 days assumes somebody reads it, acts on it, and finishes. Each rung below exists because the one above it can be missed, and each one asks for something different.
Five things to do once
How DomainGuard checks it
Expiry date, registrar, domain age and web host, from the registry record rather than a registrar dashboard. It works the same whether the name is at one registrar or seven, because the source is the registry either way.
Unlimited domains, checked whenever you press scan, results kept. Free accounts get no automatic scanning — the honest version is that you still have to open it. The two things that do run on their own are dark-web breach checks and alerts when a vulnerability is published for software found on your sites.
Domains re-checked daily without being asked, and the expiry alert with them: 25 domains on Starter, 100 on Pro, unlimited on Enterprise. Plans are bought through Apple in-app purchase.
Almost certainly, and probably at the normal renewal price. Most registrars keep an expired name in a renewal grace period before deleting it, and that period is registrar policy rather than an ICANN rule, so call or renew online now rather than reading about it. It gets expensive once the registrar deletes the name and the registry's 30-day Redemption Grace Period starts, because restoring from redemption carries a fee well above a renewal.
A 30-day window that ICANN requires gTLD registries to offer after a registrar deletes a registration. The registry must disable DNS resolution and refuse transfers during it, so the site and the email stay down, and only the registrar that deleted the name can restore it at the registrant's request. After those 30 days the name spends 5 days in Pending Delete and then drops.
Auto-renew is an instruction to attempt a charge, not a guarantee that the charge succeeds. It fails on an expired card, on a per-domain toggle nobody set, on a domain sitting in an account you forgot about, and on an account with a compliance hold. Monitoring is what tells you the attempt did not happen.
Because they go to the registrant email on the registration record, which is exactly the field that goes stale, and because a registrar can only remind you about names it holds. Split your domains across two registrars and neither one can show you the full list.
It reads the registry record for each domain and reports the expiry date, the registrar, the domain age and the host, alongside the rest of the checkup. On a free account that runs whenever you press scan, on unlimited domains. Paid plans re-check without being asked: 25 domains on Starter at $6.99 a month, 100 on Pro, unlimited on Enterprise. That is where the expiry alert lives.
Domain portfolio management
Building the list you cannot monitor without, then keeping it current.
What domain monitoring is
The five layers a domain is made of, and how each one fails.
DNS change monitoring
What a structured diff of your DNS records catches, and how alerts are set up.
Tools compared
Registrar alerts, uptime monitors, brand protection, DIY scripts and all-in-ones.
Website security checklist
Items to work through, each with a command to verify it yourself.
The free tools
Domain checkup, IT checkup, lookalike domain check and the password checker.
