Domain Expiry: The Outage Nobody Monitors

Domain expiration monitoring is the least glamorous check in your stack, and the one with the worst worst-case. When a certificate expires, visitors see a scary warning. When your domain expires, there is no site, no API and no email, and unlike almost every other outage the recovery path can involve grace fees, redemption fees measured in hundreds of dollars, and in the worst case an auction where you bid against strangers for your own name. It's the outage nobody monitors, because everyone assumes auto-renew has it covered. So did most of the teams it happened to.

How domains actually lapse

Domains rarely expire because nobody cared. They expire because the renewal process has quiet single points of failure that sit undisturbed for years:

• The card on file expired. Auto-renew was on. The charge failed. The registrar retried, emailed a warning, gave up. Nobody was watching the account.
• The registrant email is dead. Renewal reminders go to the address on the registrar account: often a founder's old address, an ex-employee, or admin@ on a domain that stopped forwarding. Worse: if the contact address is on the expiring domain itself, the moment DNS is suspended, the warning emails become undeliverable. The failure hides its own alarm.
• The person who owned it left. The domain was registered by an early engineer, an agency, or a founder's personal account. They moved on; the login, the payment method and the reminders went with them.
• It's the forgotten domain. The primary domain is safe; it's the .co redirect, the regional ccTLD, the domain that only serves your email or your API's CDN alias that quietly lapses. Every domain your infrastructure references is a dependency.
• Registrar and legal edge cases. An expired credit card plus a WHOIS-verification email nobody clicked, a chargeback, a registrar policy change. Rare individually; common in aggregate.

Note what's absent from that list: negligence. This is ordinary organizational drift, which is exactly why "we'd never let that happen" is not a control.

The timeline: what recovery costs at each stage

For gTLDs (.com, .net, .org, and most modern TLDs), expiry is not a cliff. It's a conveyor belt with a price that rises at every stage. Exact windows vary by registrar and TLD, but the standard shape is:

Three things make this worse than the table suggests. First, the outage begins at the top, not the bottom: DNS typically stops resolving in the grace period, so you're down for the whole conveyor ride. Second, email dies with DNS, which takes out password resets, MFA codes and the registrar's own warnings in one stroke. Third, a domain with real traffic is valuable precisely because you built it. Expired-domain hunters watch drop lists specifically for names with backlinks and type-in traffic, so the final stage is a sellers' market and you're the motivated buyer.

It happens to names you know

This is not a small-team problem. Microsoft failed to renew hotmail.co.uk in 2003; a member of the public renewed it and handed it back. Foursquare briefly went dark in 2010 when its domain lapsed. Similar incidents, well-known companies knocked offline because a renewal failed or the reminder went to a dead mailbox, have recurred ever since, including at companies with entire IT departments. The lesson isn't that those teams were careless. It's that domain renewal is a process failure mode, and processes need monitoring, not confidence.

What to actually monitor

Auto-renew is the right baseline, as it is for certificates, and as with certificates it needs an independent check watching the outcome, not the intention:

• Expiry date via WHOIS/RDAP. RDAP is the structured successor to WHOIS and returns the registry's own expiration timestamp. Monitor it for every domain you own, including redirects, ccTLDs and email-only domains, and alert at 60, 30 and 14 days. Sixty days is a calm fix; fourteen means your renewal automation is broken and a human needs to log into the registrar today.
• Nameserver (NS) changes. When a registrar suspends an expiring domain, the first visible symptom is usually the NS records flipping to parking servers. An NS-change alert catches a lapse in progress, and also catches hijacks and unauthorized transfers, which look the same.
• Registrar and status changes. RDAP exposes domain status codes; seeing redemptionPeriod or a registrar change you didn't make is a page-someone-now event.
• The boring account hygiene monitoring can't do for you: registrar account on a shared/role email that's on a different domain, current payment card, transfer lock on, and more than one person with access.

Set it up once, stop thinking about it

This is a job for machines: a date, checked daily, alerted early, across every domain you own. CompleteStatus's domain-expiry monitoring reads the registry's expiry date over RDAP and alerts at 60, 30, 14 and 7 days out, and its DNS monitoring flags NS and record changes on the next check. Both sit in the same dashboard as your uptime, SSL and security monitoring, so the forgotten domains get the same coverage as your primary. Inspect any domain's records now with the free DNS lookup tool, then add your domains to monitoring: ten monitors on the free tier, commercial use allowed.