Domain Expiry, Grace and Redemption Periods: Protect Your Domain

Losing a domain is one of the few website failures that can be permanent. Your site disappears, email stops, and in the worst case someone else registers the name. After reading this guide you will understand the stages a domain passes through after its expiry date, why the exact timings differ between registrars and TLDs, and what to set up today so an expiry never turns into an outage.

The registration lifecycle in general terms

A domain is not owned outright; it is registered for a term through a registrar, with the registry for the TLD holding the master record. Rules are set partly by the registry (for example the operator of .com), partly by oversight policy for generic TLDs, and partly by the individual registrar's own terms. Country-code TLDs often follow their own rules entirely.

Most domains move through these stages, though names and lengths vary:

Auto-renew grace period

Right after the expiry date, many registrars hold the domain in a grace window during which you can still renew at the normal price. During this time the registrar often changes your DNS to a parking page or stops your nameservers from being served, so a website and mail outage can begin before the domain is anywhere near being deleted. Do not treat the grace period as extra time to renew safely; treat it as a window in which you are probably already offline.

Redemption period

If the domain is not renewed, it can enter a redemption stage. The name is not in service, and getting it back usually requires a restoration fee on top of the renewal cost. The domain is often removed from DNS entirely in this stage. Restoration is done through the registrar, which in turn asks the registry.

Pending delete

Once redemption ends, the domain generally enters a short pending-delete state after which it is dropped. In this phase restoring it is typically no longer possible. After deletion the name goes back into the pool; for valuable names, automated backorder systems compete to register it the instant it is released.

Why registrar behaviour differs

Even for the same TLD, two registrars can differ in the following ways:

• how long after expiry they let you renew at normal price
• whether they keep DNS resolving during grace
• how they handle auctions of expired names (some registrars sell expiring domains or take their share of an auction)
• what they charge for redemption
• whether renewals can be made by people other than the original account holder

What happens to your website and email

When delegation or DNS is removed, the effects are immediate and broad:

• Website: the hostname stops resolving or lands on a registrar parking page. Browsers show errors, and search engines may start dropping pages if the outage persists.
• Email: MX records vanish, so inbound mail bounces or is queued by senders for a while and then returned. Outbound mail may fail SPF and DKIM checks because those TXT records are no longer reachable.
• Everything else that depends on the name: TLS certificate renewals (domain validation fails), API endpoints, single sign-on, password-reset links, and any integrations that use the domain for authentication.
• Dangerous aftermath: if the domain is later registered by someone else, they can receive mail intended for you, including password-reset emails for accounts tied to that address. That is the real reason to prevent a lapse rather than relying on recovery.

If you are not sure how a domain behaved in the past, DNS History can reveal previous records, and the Nameserver Lookup shows whether delegation is still in place.

How to protect your domains

1. Turn on auto-renew, and make sure payment works

Auto-renew only helps if the card on file is valid and the renewal date does not coincide with an expired card. Review payment methods at least once a year, and prefer a method that does not depend on a single person's personal card. A renewal that fails silently is as bad as not having auto-renew.

2. Register for multiple years

Multi-year registration reduces the number of occasions on which something can go wrong. It is not a substitute for monitoring, but for important names it moves the risk further out. Note that a longer term does not on its own make the domain safer from transfers or hijacks.

3. Keep contact details current, with an address you will actually read

Renewal notices, transfer confirmations and verification emails are sent to the registrant or account contact email. Common failures:

• the contact is an address on the domain itself, so if the domain lapses, you cannot receive the reminders
• the address belongs to a former employee, a web agency, or a personal mailbox no one checks
• the registrar's emails land in spam

Use a mailbox on a different domain, ideally a role-based shared address monitored by more than one person, and add a second contact if the registrar allows it.

4. Enable registrar lock and strong account security

A registrar lock (often shown as "transfer lock", with the registry-level equivalent called clientTransferProhibited status) blocks unauthorised transfers away from your registrar. Some registries and registrars also offer a stronger registry lock for high-value names, typically with manual verification steps. Protect the registrar account itself with a unique password and multi-factor authentication, because an attacker who controls the account controls the domain.

5. Set expiry alerts independent of the registrar

Registrar reminders are useful but depend on delivery. Add your own layer of monitoring. The Domain Expiry Watch tool alerts you ahead of expiry, and alerts should go to more than one person. An uptime monitor on the site and on a mail-related check also helps you notice the day a domain stops resolving.

6. Keep an inventory

Write down every domain, its registrar, expiry date, who pays, and what it is used for. Forgotten side domains (old campaigns, typo-protection names, redirects) are exactly the ones that lapse. Review it each quarter and drop what you no longer need deliberately, rather than letting it expire by accident.

Checking expiry with WHOIS and RDAP

Both WHOIS and RDAP expose registration data. WHOIS is the older plain-text protocol with inconsistent formatting. RDAP (Registration Data Access Protocol) is its structured, JSON-based successor, and registries and registrars are moving to it. For gTLDs, much personal data is now redacted in public output, so you will often see the registrar, key dates and status codes but not contact names.

Useful fields:

• Expiry date: the registry's expiration date, which may differ from the date shown in your registrar control panel.
• Status codes: values such as clientTransferProhibited (lock on), autoRenewPeriod, redemptionPeriod and pendingDelete, which tell you which lifecycle stage a domain is in.
• Nameservers: the delegation currently in the registry.

Try it with the WHOIS Lookup, or from a terminal:

whois example.com | grep -iE 'expir|status|registrar'

If you are evaluating an existing name, the Domain Age Checker gives registration history, which also helps when assessing the trustworthiness of a domain you are buying or linking to.

If a domain has already expired

1. Log in to the registrar immediately and look at the domain's status and renewal options. Do not wait for the site to come back on its own.
2. Renew at once if the registrar allows it. If the domain is already in redemption, ask the registrar for the restore procedure and the fee.
3. Check DNS after renewal. The registrar may need to restore nameservers; confirm delegation and records with the DNS Checker. Cached "not found" results may persist briefly as described in how long DNS propagation takes.
4. Verify email: look for bounces, and test that MX, SPF, DKIM and DMARC records are intact.
5. Re-check certificates; if renewals failed during the gap, reissue them.
6. Fix the root cause: payment method, contact address, ownership of the account, and alerting.

If the domain has already been released and registered by a third party, you are dealing with a different problem: negotiate a purchase, or in cases of trademark infringement, consult the dispute-resolution procedures that apply to your TLD. That is a legal and commercial matter, not a technical one, so seek proper advice.

Next steps

• Set up expiry alerts with Domain Expiry Watch.
• Review registrar, status codes and nameservers using the WHOIS Lookup and Nameserver Lookup.
• Read DNS explained for website owners to understand what disappears when a domain lapses.
• Prepare for related renewals in how to renew an SSL certificate and automate it.

FAQ

How long is the grace period after a domain expires?

It varies by TLD and by registrar. Some give a few weeks to renew at normal price, others a much shorter window, and some registrars take the site offline immediately. Check your registrar's written expiry policy rather than assuming a number.

Will my website stay online during the grace period?

Not necessarily. Many registrars replace your DNS with a parking page soon after the expiry date, even while you can still renew. Assume that the site and email may stop working on the expiry date itself.

Is it more expensive to renew during redemption?

Generally yes. Recovering a domain from redemption typically involves a restoration fee on top of the renewal cost, and the amount depends on the registry and registrar. It is much cheaper to renew before expiry.

Does registering for ten years protect me?

It reduces how often a renewal can fail, but it does not protect against account compromise, an unpaid invoice with a reseller, or the registrar itself having problems. Combine it with locks, correct contacts and independent expiry monitoring.

What is the difference between WHOIS and RDAP?

Both publish registration data. WHOIS is the older text-based protocol with free-form output, while RDAP returns structured JSON and supports modern access controls. For checking expiry and status codes, either works.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.