Where the answer comes from
We use RDAP, the Registration Data Access Protocol. It is the structured, JSON-speaking replacement for WHOIS, and it is what registries for generic top-level domains are required to run. We find the right registry server through IANA's bootstrap file (the official list of which server answers for which TLD), send one query for the registered domain and read the answer.
If you type a subdomain such as shop.client.co.uk we look up the part that is actually registered, client.co.uk. Nobody renews a subdomain.
What each line means
| Field | What to look for |
|---|---|
| Expires | The registration end date. Past this, the domain enters the registrar's grace and recovery periods, and the website and email usually stop. |
| Registrar | The company the domain is registered through. If it isn't the one you (or your client) think it is, find out why before renewal day. |
| Transfer lock | client transfer prohibited means the registrar blocks transfers until someone removes the lock. It's cheap insurance against hijacking. |
| Statuses | RDAP status values. redemption period or pending delete mean the domain has already expired and is on its way to being released. |
| Nameservers | Where DNS for the domain lives. An unexpected change here moves the website and email somewhere else. |
Why domains lapse even with auto-renew on
Auto-renew is a promise to try to charge a card on file. It fails more often than people expect, and it fails quietly:
- The card expired or was replaced, and the renewal notice went to an address nobody reads.
- The domain sits in the client's own registrar account, under a former employee's email.
- The registrar account was set up by a freelancer three agencies ago.
- The domain was transferred and auto-renew defaulted to off at the new registrar.
None of these show up until the site goes down. By then you are in the grace period at best, paying a redemption fee at worst, and explaining to a client why their email stopped on a Saturday.
When the lookup says it can't help
Some country-code registries don't publish registration data over RDAP, or publish it without an expiry date. The checker tells you when that happens instead of guessing. For those domains, the registrar's control panel is the source of truth, and it is worth putting the date somewhere a machine will remind you.
A handful of registries also rate-limit RDAP queries. If a lookup fails, trying again a minute later usually works.
A short checklist for client domains
Whenever you take on a client, or once a year for the ones you have, it pays to answer five questions for every domain the business depends on. Most of the answers are in the lookup above; the rest take one email.
- Who is the registrant, and can they still log in to the registrar account? If the answer is "the old web designer", fix it now, while nothing is on fire.
- Which email address receives renewal notices, and does a human read it?
- Is auto-renew on, and is the card on file valid past the expiry date?
- Is the transfer lock on? If not, is there a reason?
- Are the nameservers the ones you expect? A change you didn't make can move the website and every mailbox in one step.
Keep the answers with the client's other records. The next person to inherit the account will thank you, and that person might be you.
Watching domains, not just checking them
ExpiryOwl re-reads registration data for every monitored domain daily, and twice a day once expiry is within 30 days. You get a warning well before the date, and separate alerts when the registrar, the transfer lock, the status or the nameservers change, because a nameserver change you didn't make is worth knowing about within the hour. The certificate side lives in the SSL checker; the full walkthrough is in our domain expiry monitoring guide.