How long do I have after a .com domain expires?

ICANN's Expired Registration Recovery Policy guarantees reminders and a renewal window before the registrar deletes the name, then a 30-day redemption period at the registry, then five days of pending delete. How long the registrar waits before deleting depends on its own terms, so check your registration agreement.

Is WHOIS still available for domains?

For gTLDs, ICANN has required RDAP since 28 January 2025, and registries and registrars are no longer required to run WHOIS (ICANN lists .com, .name and .post as exceptions). RDAP is the supported, structured way to read registration data now.

What does clientTransferProhibited mean?

It tells the registry to reject requests to transfer the domain to another registrar. It is a normal protective status, so the time to worry is when it disappears unexpectedly.

Do these rules apply to country-code domains?

No. The ERRP covers generic TLDs. Country-code domains such as .uk, .de or .bh follow their own registry's policies, so check each one.

Guide · Domains

Domain expiry monitoring: what really happens when a domain lapses

Checked against sources on 2026-09-25 · 5 min read

Why domains lapse even with auto-renew on

Auto-renew is a promise to try, not a promise to succeed. Near the expiry date the registrar tries to charge the payment method on file. If that fails, it emails the registrant contact. If nobody reads that inbox, the next person to notice is usually the client, when their site and their email stop working on the same morning.

The causes are boring, which is exactly why they keep happening:

The card on file expired, or was reissued after a fraud alert, and nobody updated it at the registrar.
The registrant email belongs to someone who left the company, or to a freelancer who built the first site years ago.
The domain sits in the client's own registrar account, the client assumed the agency handled renewals, and the agency assumed the opposite.
Auto-renew was switched off during a transfer or a billing dispute and never switched back on.

What ICANN's rules guarantee, and what they don't

For generic top-level domains (.com, .net, .org and the rest), ICANN's Expired Registration Recovery Policy (ERRP) has set a floor for registrars since 31 August 2013. The parts that matter:

Reminders before expiry. At least two notices: one roughly a month before the registration expires and one roughly a week before.
One more after. Within five days of expiry, at least one further notice with instructions for renewing.
DNS gets interrupted. For at least the final eight consecutive days before the registrar deletes the name, the existing DNS resolution must be interrupted. If visitors are sent to a parking page, that page must say plainly that the registration has expired.
You can still renew. The registrant must be allowed to renew during that interruption period.
Fees are published. Renewal, post-expiration renewal and redemption fees must be shown on the registrar's website and linked from its registration agreement.

Once the registrar deletes the name, all gTLD registries except sponsored ones must offer a 30-day Redemption Grace Period. DNS stays off and transfers are blocked, but the name can still be restored through the registrar, normally for a restore fee on top of the renewal. ICANN's EPP status code reference describes the end of the road: five calendar days after the redemption period ends, the name is purged from the registry and anyone can register it.

What the policy does not fix is how long the registrar keeps an expired name before deleting it. That is in the registrar's own terms. Country-code domains such as .uk, .de or .bh are outside ERRP entirely and follow their registries' rules.

The gTLD lifecycle under ICANN's ERRP. Registrar-specific timings vary.
Stage	What visitors see	Can you get it back?
Before expiry	The normal site	Yes, renew as usual
Expired, not yet deleted	The site for a while, then nothing or a parking page once DNS is interrupted	Yes, renew at the registrar
Redemption period (30 days)	Nothing, DNS is disabled	Usually, with a restore fee
Pending delete (5 days)	Nothing	No
Purged	Whoever registers it next	Only by registering it again, if you get there first

RDAP has replaced WHOIS for gTLDs

Domain monitoring used to mean scraping WHOIS text, with every registry formatting it slightly differently. For gTLDs that is over. ICANN's RDAP page states that since 28 January 2025 all gTLD registries and registrars must provide RDAP, and are no longer required to provide WHOIS (ICANN lists .com, .name and .post as exceptions).

RDAP, the Registration Data Access Protocol, returns JSON with defined fields. You find the right server for a TLD through IANA's bootstrap file, a process described in RFC 9224, and then ask that server about the domain:

# Which RDAP server answers for .com?
curl -s https://data.iana.org/rdap/dns.json | grep -o '"https://rdap.verisign.com/com/v1/"'

# Ask it about a domain
curl -s https://rdap.verisign.com/com/v1/domain/example.com

The response carries an events array (the entry with eventAction set to expiration is the one you want), a status array and a nameservers list. When we ran it for example.com while writing this, the expiration event read 2027-08-13 and the statuses were client delete, transfer and update prohibited. RDAP spells statuses as phrases, and RFC 8056 maps them to the older EPP codes, so clientTransferProhibited becomes "client transfer prohibited".

What to watch, beyond the date

Expiration date. The obvious one. Also watch that it moves after the renewal date passes. If it hasn't, the renewal didn't happen, whatever the registrar dashboard toggle says.
Transfer lock. clientTransferProhibited tells the registry to reject requests to move the domain to another registrar. It is a normal, protective status. Worry when it disappears and nobody on your side removed it.
Hold statuses. clientHold or serverHold means the domain is not active in DNS and will not resolve, even if it is paid up.
Redemption and pending delete. If you see redemptionPeriod or pendingDelete, you are already in the lower half of the table above.
Nameservers. A nameserver change you didn't make is either a colleague moving DNS without telling anyone, or something worse. You want to know the same day either way.
Registrar. A registrar change you didn't plan means the domain has moved.

A checklist for agencies holding client domains

Make one list of every domain you are responsible for, including the ones the client owns but phones you about when they break. Note whose registrar account each one lives in and who pays.
Check the registrant email on each. It should be a role address the client actually reads (domains@ is a good pattern), not a person.
Put renewals on a payment method that doesn't leave with an employee. Company cards get reissued too, so check card expiry dates each quarter.
Turn on auto-renew and the transfer lock at the registrar.
Monitor the expiration date through RDAP and alert before the registrar's first reminder would arrive. Sixty days out is sensible for anything that matters.
Alert on status, registrar and nameserver changes, not only on dates.
For your ten most important domains, write down the registrar's post-expiry terms: how long before deletion, and what a restore costs.
Agree in writing who owns each renewal, the agency or the client. The most expensive sentence in agency work is "I thought you had it."

You can check a single name now with our free domain expiry checker, and the SSL checker covers the certificate on the same host. If you are a freelancer carrying a handful of client domains in your own account, our page for freelance developers covers that setup, and the guide on what happens when SSL expires is the certificate half of the story.

ExpiryOwl checks domains daily over RDAP (expiry date, registrar, statuses, transfer lock and nameservers) and alerts at 30, 14, 7, 3, 1 and 0 days. The free plan covers 5 domains and needs no card.