Domain Expiry — The Outage Nobody Monitors

Domain expiration monitoring is the least glamorous check in your stack, and the one with the worst worst-case. When a certificate expires, visitors see a scary warning. When your domain expires, there is no site, no API, no email — and unlike almost every other outage, the recovery path can involve grace fees, redemption fees measured in hundreds of dollars, and in the worst case an auction where you bid against strangers for your own name. It's the outage nobody monitors, because everyone assumes auto-renew has it covered. So did most of the teams it happened to.

How domains actually lapse

Domains never expire because nobody cared. They expire because the renewal process has quiet single points of failure that sit undisturbed for years:

• The card on file expired. Auto-renew was on. The charge failed. The registrar retried, emailed a warning, gave up. Nobody was watching the account.
• The registrant email is dead. Renewal reminders go to the address on the registrar account — often a founder's old address, an ex-employee, or admin@ on a domain that stopped forwarding. Worse: if the contact address is on the expiring domain itself, the moment DNS is suspended, the warning emails become undeliverable. The failure hides its own alarm.
• The person who owned it left. The domain was registered by an early engineer, an agency, or a founder's personal account. They moved on; the login, the payment method and the reminders went with them.
• It's the forgotten domain. The primary domain is safe — it's the .co redirect, the regional ccTLD, the domain that only serves your email or your API's CDN alias that quietly lapses. Every domain your infrastructure references is a dependency.
• Registrar and legal edge cases. An expired credit card plus a WHOIS-verification email nobody clicked, a chargeback, a registrar policy change. Rare individually; common in aggregate.

Note what's absent from that list: negligence. These are ordinary organizational entropy, which is exactly why "we'd never let that happen" is not a control.

The timeline: what recovery costs at each stage

For gTLDs (.com, .net, .org, and most modern TLDs), expiry is not a cliff — it's a conveyor belt with a price that rises at every stage. Exact windows vary by registrar and TLD, but the standard shape is:

Three things make this worse than the table suggests. First, the outage begins at the top, not the bottom — DNS typically stops resolving in the grace period, so you're down for the whole conveyor ride. Second, email dies with DNS, which takes out password resets, MFA codes and the registrar's own warnings in one stroke. Third, a domain with real traffic is valuable precisely because you built it — expired-domain hunters watch drop lists specifically for names with backlinks and type-in traffic, so the final stage is a sellers' market and you're the motivated buyer.

It happens to names you know

This is not a small-team problem. Microsoft famously failed to renew hotmail.co.uk in 2003 — a member of the public renewed it and handed it back. Foursquare, in its 2010 heyday, went dark when its domain lapsed. The broader class of incidents — household-name companies knocked offline, or critical services disrupted, because a renewal email went to a dead mailbox — has recurred steadily ever since, across companies with entire IT departments whose job was ostensibly to prevent exactly this. The lesson isn't that those teams were careless; it's that domain renewal is a process failure mode, and processes need monitoring, not confidence.

What to actually monitor

Auto-renew is the right baseline, exactly like auto-renewal for certificates — and exactly like certificates, it needs an independent check watching the outcome, not the intention:

• Expiry date via WHOIS/RDAP. RDAP is the structured successor to WHOIS and returns the registry's own expiration timestamp. Monitor it for every domain you own — including redirects, ccTLDs and email-only domains — and alert at 60, 30 and 14 days. Sixty days is a calm fix; fourteen means your renewal automation is broken and a human needs to log into the registrar today.
• Nameserver (NS) changes. When a registrar suspends an expiring domain, the first visible symptom is usually the NS records flipping to parking servers. An NS-change alert catches a lapse in progress — and also catches hijacks and unauthorized transfers, which present the same way. (More in our guide to DNS monitoring: what to watch.)
• Registrar and status changes. RDAP exposes domain status codes; seeing redemptionPeriod or a registrar change you didn't make is a page-someone-now event.
• The boring account hygiene monitoring can't do for you: registrar account on a shared/role email that's on a different domain, current payment card, transfer lock on, and more than one person with access.

Set it up once, stop thinking about it

This is the perfect job for machines: a date, checked daily, alerted early, across every domain you own. CompleteStatus's domain-expiry monitoring tracks WHOIS/RDAP expiration with tiered alerts, and its DNS monitoring catches NS and record changes the moment they happen — in the same dashboard as your uptime, SSL, and security monitoring, so the forgotten-domain problem gets the same coverage as your primary. Inspect any domain's records right now with the free DNS lookup tool, then add your domains to monitoring free — ten monitors on the free tier, commercial use allowed.