An expired domain takes down everything at once: the website, email on the domain, APIs, and every subdomain, all replaced by a parking page. It happens to companies of every size, usually for a mundane reason like an expired card on file or a renewal notice sent to an old inbox. And unlike most outages, the worst case isn't downtime. It's someone else registering your domain. This guide walks through exactly what happens when a domain expires, stage by stage, and how to make sure it never happens to a domain you're responsible for.
The Expiration Timeline, Stage by Stage
A domain doesn't vanish at midnight on its expiry date. It moves through a sequence of stages, and each one raises the cost of getting it back:
- Expiry day. The domain stops resolving. Your registrar typically points it at a parking page, and everything that depends on the domain breaks at once: website, email, APIs, subdomains.
- Grace period (roughly 0 to 45 days, registrar dependent). Most registrars let you renew at the normal price during this window. Your site is down the entire time, but recovery is cheap and quick. Some registrars also auction the domain during this stage.
- Redemption period (typically 30 days). The registry pulls the domain back. You can usually still recover it, but only through a redemption process with a fee that often runs $80 to $200 on top of the renewal.
- Pending delete (about 5 days). The domain is scheduled for release. Nobody can renew it now, not even you.
- The drop. The domain becomes publicly available, and this is where it gets ugly. Domains with traffic and backlink history are snapped up within seconds by automated drop-catching services, then held for ransom, loaded with ads, or worse.
The lesson from the timeline: every stage past the first is more expensive and less certain than the one before it. The fix is to never enter it.
Why This Is a Security Problem, Not Just an Outage
Whoever registers your dropped domain inherits more than a URL. They inherit your traffic, your backlinks, and, most dangerously, your email. They can receive mail sent to your old addresses, trigger password resets on accounts registered under the domain, and put up a convincing copy of your site to phish your customers. Expired domains are also prime real estate for malware distribution, because they come with built-in reputation and inbound links. This is why domain expiration belongs on the same watchlist as SSL certificates and DNS records: all three are quiet administrative details until the day one of them becomes a security incident.
Why Domains Still Expire by Accident
Auto-renew should make this impossible, and yet it keeps happening, because auto-renew fails silently in predictable ways:
- The card on file expired or was replaced after a billing change, and the renewal charge quietly failed.
- Renewal notices go to a dead inbox: an ex-employee, a former developer, or an address on the expiring domain itself.
- Ownership is ambiguous. The domain was registered years ago by a contractor or a founder's personal account, and nobody currently at the company can even log in.
- Sprawl. Agencies and larger companies hold dozens or hundreds of domains across multiple registrars. A spreadsheet with renewal dates is out of date the day it's written.
If you manage client websites, this risk is doubled: the domain is usually in the client's registrar account, outside your control, but the 7am "the website is down" call comes to you.
How to Make Sure It Never Happens
Belt and suspenders, in order of impact:
- Turn on auto-renew everywhere, and keep a current payment method at every registrar. Do the same audit for clients during onboarding.
- Renew for multiple years on domains that matter. It's cheap insurance and moves the risk horizon out.
- Enable registrar lock so the domain can't be transferred away without extra verification.
- Route renewal notices to a shared inbox that outlives any single employee, and never to an address on the domain itself.
- Monitor expiry dates independently. This is the layer that catches everything above when it fails. Domain expiration data is public via WHOIS, so an external monitor can watch every domain you care about, including client domains you don't control, and alert you 30, 14, and 7 days out. That turns a silent auto-renew failure into a calm email instead of a dead website.
That last layer matters because it's the only one that doesn't depend on the registrar account being configured correctly. Everything else can fail without a sound; the monitor is what makes the failure audible.
Where Sentinel Fits
Sentinel includes domain expiration monitoring as a built-in check: add a monitor for any domain, yours or a client's, and it tracks the WHOIS expiry date and alerts you well before the deadline, on your chosen threshold. Pair it with SSL certificate monitoring and DNS monitoring on the same monitor and the three quietest causes of catastrophic downtime are all covered, with alerts by email, SMS, or Slack. The free plan needs no credit card, so you can add your domains and stop relying on the registrar's reminder emails today.