What happens when a domain expires: timeline, costs and recovery

An expired domain is not a deleted domain. That’s worth saying first, because most people who land on this page needed to hear it about ten minutes ago.

For most .com-style domains, there’s roughly 65 to 80 days between the expiry date and the moment the name is gone for good. Three checkpoints sit inside that window. The price of getting the domain back climbs at every one.

But here’s the part that catches owners out. The website and the email usually stop working in the first week — long before the domain itself is at any real risk. So the panic arrives early, and the actual deadline arrives much later.

This guide walks the whole process. What breaks, in what order, what it costs, and what can still be done at each stage.

The short answer

A domain doesn’t vanish on its expiry date. It moves through a renewal grace period (roughly 30 days, sometimes as little as one), then a 30-day redemption period where recovery costs a restore fee of $80–$250+, then a 5-day pending-delete window where nothing can be done. After that it drops and anyone can register it.

Already expired? → Jump to the first-24-hours checklist

What stops working — and how fast

Nobody discovers an expired domain by checking a calendar. They discover it because a client says an email bounced.

Here’s the order things fail in.

The website — and why it may stay up for a few days

DNS caching buys a little time. Resolvers around the world hold onto the old records for as long as the TTL says. Set a 24-hour TTL, and some visitors keep reaching the site for a day after the registrar has already pulled the plug.

This is the cruellest part of the whole process. The site looks fine to the owner, who checked it an hour ago from a machine with a warm cache.

Then the nameservers change. The registrar swaps them for its own parking nameservers. Visitors get a generic “this domain is parked” page — often with ads on it, sometimes with a “buy this domain” button.

Then clientHold lands. At this point the registrar tells the registry to stop publishing the domain entirely. Nothing resolves. Not the website, not a subdomain, not the mail server. The domain is functionally invisible.

The email — the damage that can’t be undone

This is the loss that owners underestimate, and it’s permanent.

When the zone goes, the MX records go with it. Sending servers look up where to deliver mail for the domain, find nothing, and give up.

• Inbound mail bounces. It isn’t held in a queue somewhere waiting for the domain to come back.
• Most sending servers retry for a while — commonly 24 to 72 hours — then return the message and stop.
• Anything sent after that window is simply gone. No archive, no recovery, no support ticket that fixes it.
• Outbound mail stops too, and any reply-to address on the domain is dead.

Consider what a bounce message actually communicates. A prospective client sends a quote request. It comes back marked undeliverable, host not found. That doesn’t read as “billing hiccup.” It reads as this business has closed.

Several days of that is a marketing problem long after the technical problem is fixed.

The SSL certificate — a second, separate clock

A certificate does not expire because the domain expired. Those are two independent timers.

What breaks is renewal.

Let’s Encrypt certificates last 90 days by default, and the recommended practice is to renew at day 60. There’s also a six-day short-lived option that renews every three days. Either way, renewal depends on domain control validation — the certificate authority checks that the applicant genuinely controls the name, validating from multiple network perspectives.

A domain sitting in redemption can’t pass that check. The zone is gone. HTTP and DNS challenges both fail.

So the sequence runs like this:

1. Domain expires, DNS goes dark
2. The existing certificate keeps ticking down
3. Automated renewal fails, quietly, in a cron job nobody reads
4. The domain comes back
5. The certificate has since expired, and every visitor now hits a full-page browser security warning

Owners fix the domain, celebrate, and then spend another afternoon working out why the site looks broken.

Email authentication goes down with the zone

SPF and DMARC live as TXT records in the same DNS zone as everything else. When the zone stops being authoritative, those records stop resolving too.

They aren’t deleted from the old DNS provider. They just stop being the ones the internet asks.

Everything quietly attached to the domain

This list is always longer than expected:

• Google Workspace and Microsoft 365 sign-in
• Single sign-on for internal tools
• Password-reset addresses for every SaaS account the business owns
• API callbacks and webhooks pointing at subdomains
• Contact addresses on file with payment processors and app stores
• Business cards, van livery, printed brochures, QR codes on packaging

What doesn’t get lost

Some good news, and it matters for the panic level:

• Hosting files stay put
• Databases stay put
• Backups stay put
• Website content is untouched

Hosting is a separate contract on a separate clock. The domain is the signpost, not the building.

The four “expiries” people mix up

A lot of confusion in support tickets comes down to this. Four different things expire, they break in different ways, and they’re often billed by four different companies.

A useful rule of thumb: if the browser shows a security warning, that’s the certificate. If it shows “server not found”, that’s DNS or the domain. If the page loads but shows a host’s default placeholder, that’s hosting.

Domain Monitor Hub tracks three of these four — registration expiry, SSL, and DNS — in one place, which is mostly a way of not having to remember which company to phone.

A 30-second primer: domains are leased, not owned

Nobody owns a domain name. Everybody rents one, and the rental has an end date.

Registry, registrar, registrant

Three parties, three jobs:

• The registry runs the top-level domain and holds the master record. Verisign runs .com and .net. PIR runs .org. Nominet runs .uk. DENIC runs .de.
• The registrar is where the domain gets bought — GoDaddy, Namecheap, Cloudflare, Squarespace. They’re a licensed middleman.
• The registrant is the person or company whose name is on the registration.

This matters for one practical reason. When a domain slides into redemption, the registrar can’t just wave it through. The registry sets the clock and the restore fee, and the registrar pays that fee upward before passing it on.

So the eye-watering recovery invoice usually isn’t the registrar being opportunistic. Mostly.

Why registrations end at all

Domains are sold in terms of one to ten years. Renewal is the registrant’s responsibility — not the web designer’s, not the host’s, not the agency that built the site four years ago.

That last point causes more lost domains than any technical failure.

The domain expiration timeline, day by day

Here’s the whole lifecycle in one view. Day counts are typical for gTLDs like .com, .net and .org. Country domains play by different rules — see below.

Day 0 — the expiry date

Auto-renew fires, or doesn’t. The registry flips the record to expired.

The site often still resolves. Which is exactly why this day passes unnoticed.

Days 1–30 — the renewal grace period

The cheap window. Renew here and it costs what renewal always costs, occasionally with a small late fee bolted on.

It’s discretionary, not a right. This is the most widely misunderstood fact in the whole topic. ICANN permits registrars to offer a post-expiry renewal window of anywhere from 1 to 45 days. It doesn’t require them to offer one at all.

Some TLDs have no grace period whatsoever. Miss the date, lose the name.

The DNS suspension is deliberate. Under ICANN’s Expired Registration Recovery Policy, registrars are required to interrupt DNS for up to eight days before deletion. It looks like a malfunction. It’s a designed wake-up call — the last resort after the emails went unread.

The auction nobody mentions

Most guides describe expiry as a tidy queue. Grace, then redemption, then deletion, one after the other.

That’s not how registrars actually run it.

GoDaddy’s published expiration timeline puts expired domains into its expired domains auction around day 26, and into a final closeout auction around day 36. Both of those sit inside the window where the original owner still assumes redemption is waiting for them.

And GoDaddy’s own documentation contains the catch: recovery is possible only where no active bids exist.

So a stranger’s bid can end an owner’s ability to buy back their own domain — during a period the owner believes is theirs.

Consider a small studio whose .com lapsed while the founder was on holiday. She gets home on day 29, reads the panic emails, and thinks she has a month of redemption ahead of her. Meanwhile the name has been listed at auction for three days, and someone who tracks expiring domains with a decent backlink profile has already bid.

She can still renew — unless that bid stands.

The main players here are GoDaddy Auctions, DropCatch, NameJet and SnapNames. Most registrants have never heard of any of them until the week they need to.

Practical takeaway: anyone whose domain has recently lapsed should check whether it’s already listed at auction, not just check its WHOIS status.

Days ~30–60 — the redemption period

The expensive window, and the one with a formal name: the Redemption Grace Period, or RGP. ICANN requires every gTLD registry to provide one, and it runs for 30 days.

Three things define it:

• Only the original registrant can restore. Nobody else can buy it, bid on it, or claim it during RGP.
• A restore fee applies, and it’s a different animal from a renewal fee.
• The domain is fully dark. DNS is removed at registry level.

The restore fee pays for a manual, audited process at the registry — pulling a record out of a deletion pipeline and putting it back. It’s priced to be a deterrent, not a service.

Some registries label it differently. On .org, the equivalent state shows up as “Pending Delete – Restorable,” which reads alarmingly like the domain is already gone. It isn’t.

The last five days — pending delete

Nothing can be done here. No restore, no appeal, no fee that helps.

The registry has committed to deleting the record. Backorder services are queuing, watching the drop time, and preparing to catch the name the instant it releases.

The drop

The domain releases and becomes registrable again.

“Anyone can register it” is technically true and practically misleading. Drop-catching outfits run automated systems that fire hundreds of registration attempts per second at the exact release moment. A human typing the name into a search box is not competing on equal terms.

Domains with traffic, age or backlinks rarely survive their first second of availability.

How to tell which stage a domain is in right now

Two ways.

By hand: look up the domain’s RDAP or WHOIS record and read the status code. The status reference below translates each one.

Automatically: this is precisely what Domain Monitor Hub’s expiry tracking does — it reads the registry record, shows which stage the domain currently sits in, and sends a warning before each transition rather than after.

That distinction matters more than it sounds. Knowing a domain entered redemption last Tuesday is useful. Knowing it will enter redemption on Friday is actionable.

What recovery actually costs

Cost by stage

Real, published numbers help more than ranges. Namecheap’s redemption pricing lists .com at $88.48 and .co at $175.48, with the total calculated as the redemption fee plus the renewal price. Across registrars and TLDs, $80 to $250+ covers most cases.

Against a $12 renewal, that’s roughly a tenfold jump for missing a date.

Why the fee is so steep

Registry-set, not registrar markup. And under ICANN’s rules, registrars must make renewal fees, post-expiration renewal fees and redemption fees reasonably available in advance.

Which means those numbers are published somewhere on every registrar’s site right now — worth reading before they’re needed rather than during the emergency.

How long recovery takes

Restoring isn’t instant:

1. The registrar submits a restore request
2. The registry processes it — the domain may show pendingRestore during a roughly 7-day documentation window
3. DNS re-propagates, typically over 24–48 hours
4. Mail flow resumes once MX records are live again
5. The SSL certificate may need reissuing

Plan for days, not minutes.

Can it still be recovered? A decision path

Find the matching situation.

“It expired a few days ago.”
Renew immediately, at the current registrar. Don’t attempt a transfer first — transfers on expired domains often fail or add delay, and the clock keeps running. Re-enable auto-renew afterwards and check the card on file.

“WHOIS says redemptionPeriod.”
Contact the registrar and ask specifically for a restore, not a new registration. Expect the restore fee. Be wary of any third party offering to “recover” the domain for a fee — during RGP nobody except the original registrant can restore it, so anyone promising otherwise is selling something else.

“There’s a bid on it at auction.”
Contact the registrar’s support directly and ask what the options are. Some registrars will halt an auction for the original registrant; some won’t once bidding is live. Bidding on the domain is sometimes possible, which is an unpleasant thing to have to do.

“WHOIS says pendingDelete.”
Restoration is off the table. The realistic options are a backorder through a drop-catch service, or letting it go and planning a rename.

“Someone else already registered it.”
The honest answer: there’s no automatic right of return. Options, roughly in order of practicality:

• Buy it back — often via a broker, and expect the price to reflect how badly the buyer thinks it’s wanted
• UDRP or trademark action — viable only with genuine trademark rights and evidence of bad-faith registration. Forgetting to renew is not, by itself, grounds for getting a domain back
• Rebrand — sometimes cheaper and faster than the alternatives

“It’s sitting in a former agency’s or ex-employee’s account.”
More common than any technical failure. The route back:

1. Identify the registrar from the WHOIS/RDAP record
2. Open a registrar account-recovery or ownership-dispute case
3. Gather evidence — invoices, historical WHOIS showing the company as registrant, company registration documents
4. Once control is regained, move the domain into an account the business itself owns, with billing on a company card and notifications to a monitored address

How to read a domain’s status (WHOIS, RDAP and EPP)

Where to look

RDAP is the modern answer. It’s the structured, machine-readable successor to WHOIS, served by the registry itself and discoverable through IANA’s official directory. WHOIS still works where registries maintain it.

Why two tools sometimes disagree. Plenty of lookup sites serve cached or third-party data that lags the registry by hours or days. Registrar dashboards occasionally display a different date from the registry record. When the numbers conflict, the registry’s own RDAP response is the one that counts — it’s the source everything else is copying from.

What GDPR redaction hides. Since privacy rules tightened, public WHOIS output for many domains hides registrant names, emails and addresses. It does not hide the expiry date, the creation date, the registrar, the nameservers, or the status codes. Everything needed to diagnose an expiry problem is still public.

The status codes that matter

Two of these deserve special attention. An unexpected pendingTransfer, or a clientTransferProhibited that has quietly disappeared, are both classic early signals of a domain hijack in progress. Domain Monitor Hub watches for exactly these WHOIS changes and alerts when a lock is lifted.

The three dates

Every registry record carries three:

• Creation date — when the domain was first registered, anywhere
• Updated date — when the registry record was last touched
• Expiry date — the deadline that started this whole article

The updated date is the underrated one. It changes whenever the record is modified — a nameserver change, a registrar change, a status change, a transfer. If nothing was changed deliberately and this date moved, something happened that warrants a look.

The SEO cost

While the site is down

Googlebot hits a DNS failure and can’t fetch anything. Crawl errors accumulate in Search Console.

The demotion is gradual rather than instant. Search engines have seen millions of temporary outages and don’t scrap a site’s history over one.

A short outage — a few days — is usually survivable with little lasting damage.

When deindexing starts

There’s a meaningful difference between days and weeks. Brief downtime tends to cost rankings temporarily. Sustained downtime, measured in weeks, is when pages start dropping out of the index entirely and recovery gets slow.

Backlinks survive — their value might not

Every link pointing at the domain still points at it. Those don’t evaporate.

The risk is what happens next. If the domain changes hands and the new owner fills it with unrelated content, those links now point somewhere that has nothing to do with the original business.

Getting rankings back

After recovery:

• Restore the same URLs — changed paths turn a downtime problem into a migration problem
• Re-verify the property in Search Console
• Request indexing for the most important pages
• Check for a manual action if the domain spent time with someone else
• Watch server logs to confirm crawlers are returning

The worst case

Expired domains with decent backlink profiles get bought specifically for those links. The name gets repurposed for a private blog network, an affiliate site, or something worse.

Old links from genuine press coverage and partner sites then point at content the original owner would never want associated with the brand.

The security risk nobody warns about

This is where an expired domain stops being an inconvenience.

Whoever owns the domain owns the email

Register the domain, point the MX records anywhere, and start receiving mail sent to any address on it. Including addresses that used to belong to real staff.

Invoices. Contracts. Password resets.

Their email authentication becomes the new owner’s

Here’s the mechanism behind “they can impersonate the brand” — a claim made everywhere and explained almost nowhere.

The new owner publishes their own SPF record on the domain. Their servers now pass SPF for that name. They inherit whatever DMARC posture was left behind, and if it was p=none — a policy that reports but blocks nothing — receiving mail servers have no instruction to reject anything.

The result: mail that authenticates correctly, from the real domain, written by someone else.

A domain with two conflicting SPF records or a p=none policy looks configured. It stops nobody. Domain Monitor Hub reads SPF and DMARC records and reports in plain language whether they actually protect the domain — which is a different question from whether they exist.

Password resets and account takeover

This is not theoretical, and the software world has a documented case.

In 2022, an attacker acquired an expired domain belonging to a PyPI package maintainer, used it to receive password-reset email, took over the account, and published malicious versions of the package.

PyPI’s response says a lot about how seriously the risk is taken. Since June 2025, the platform has been checking maintainer email domains for expiry roughly every 30 days and unverified around 1,800 addresses whose domains had lapsed. The attack pattern even has a name: domain resurrection.

The lesson generalises well past software packages. Every SaaS account whose recovery address sits on a lapsed domain is one registration away from being resettable by a stranger.

Brand impersonation and residual traffic

Real people keep arriving. Old links, bookmarks, printed materials, an email signature from three years ago.

They land wherever the new owner points the domain, and they have no reason to suspect anything changed.

Even famous companies get this wrong

In 2015, a former Google employee named Sanmay Ved searched Google Domains, found google.com available, and bought it for $12. The purchase went through. He briefly received access to Search Console data for the domain before Google cancelled the transaction about a minute later.

Google paid him a bug-bounty reward of $6,006.13 — a number that spells “Google” if squinted at — then doubled it when he donated the money to charity.

If the company that runs the internet’s largest index can briefly lose its own domain, a 12-person agency with one card on file and an unread inbox is not an outlier.

Why an expiring domain is a hijack window

Attackers watch for domains that look neglected. A domain approaching expiry with an unmonitored registrar account is a good candidate.

A transfer lock quietly disappearing is the classic first move. clientTransferProhibited vanishes from the record, and days later the domain is somewhere else. Almost nobody checks their own WHOIS record often enough to notice — which is the entire reason automated WHOIS change alerts exist.

Country domains play by different rules

Everything above describes gTLDs — .com, .net, .org and the newer extensions. Country-code domains are run by national registries that set their own rules.

ICANN’s policies don’t apply to them. No guaranteed 30-day redemption. No standard grace period. Some ccTLDs delete far faster than a .com would.

A verified example: .uk

Nominet, which runs .uk, publishes a lifecycle that looks nothing like the gTLD one:

• Day 30 — the domain is suspended and a suspension notice goes out
• Up to day 90 — still renewable, at the normal price
• Day 95 — dropped and available again

No premium redemption fee at any point. A .uk owner gets a longer, cheaper recovery runway than a .com owner — and a much longer period of the site being dark.

The takeaway isn’t that .uk is better. It’s that applying the 30/30/5 gTLD rule to a country domain produces the wrong deadline.

Some ccTLDs show as expired early

A handful get marked expired at the registrar several days before the actual registry expiry date, including .CH, .ES, .FR, .LI, .PE, .SG, .DE and .EU.

Owners see an alarming status and assume something has gone wrong. Usually nothing has — but the effective deadline is earlier than the date on the invoice.

A registry holding an expiry date and a registry publishing it are two different things. Several names on that list do the first but not the second — which is the next section.

Some publish no expiry date at all

This one surprises people.

.DE, .ES and .EU, among others, simply don’t include an expiry date in their public WHOIS or RDAP output. The field isn’t hidden. It doesn’t exist.

Which means no monitoring tool anywhere can read it automatically. Any service claiming to track a .de expiry date is either guessing or has been told the date by a human.

The practical workaround is to record the renewal date once — from the registrar invoice — and set reminders against it manually. Domain Monitor Hub handles these domains by letting the date be entered by hand, after which reminders behave exactly as they do for automatically-tracked domains.

Why domains expire even when someone thought they were covered

“Auto-renew was on” appears in a remarkable number of these stories.

Eight ways auto-renew fails

1. The card expired or was declined. The most common cause by a distance. Cards expire every three years; domains often renew annually. The dates eventually collide.
2. The renewal notice went to an address on the domain that just died. A genuinely circular failure. The warning email can’t be delivered because the thing it’s warning about has already broken.
3. It was silently switched off. After a transfer, a plan change, or a registrar changing hands. Squarespace acquired all of Google Domains’ registrations in September 2023 — an ownership change of that scale is exactly the kind of event where settings and billing assumptions quietly stop matching reality.
4. The TLD isn’t eligible. Not every extension supports auto-renew at every registrar.
5. A hold or unpaid balance blocked it. The renewal attempt runs, the account is in arrears, nothing happens.
6. The domain lives in a former employee’s account. They left. The account email goes to a mailbox nobody reads.
7. A reseller in the middle didn’t renew upstream. The host bills the client happily and forgets to pay the registrar.
8. The reminders landed in spam. Or in a promotions tab, alongside forty other marketing emails.

The registrar is a single point of failure

Under ICANN’s Expired Registration Recovery Policy, registrars must send at least two reminders before expiry — roughly one month out and roughly one week out — plus one more within five days after.

Three emails. That’s the floor, and for many owners it’s also the ceiling.

Every one of those emails travels the same path, to the same inbox, subject to the same spam filter. If that path fails, the safety net fails with it — and the entity warning about the problem is the same entity whose billing just failed.

Nobody owns the domain

The organisational version, and it’s the hardest to fix:

• Staff turnover, and the person who registered it left in 2021
• An acquisition where domain assets never made the handover list
• Twelve domains spread across four registrars on three different corporate cards
• Renewals paid personally by a contractor who has since moved on

No process fails here. There was never a process.

How to make sure it doesn’t happen again

The basics, properly done

• Register for multiple years. Fewer renewal events, fewer chances to miss one.
• Keep a valid card on file and check it when it’s reissued.
• Turn the registrar lock on — clientTransferProhibited should be the default state.
• Enable 2FA on the registrar account.
• Use a registrar-account email that is not on the domain being registered. This single change breaks the circular failure in point 2 above.

Keep an ownership record

One document, wherever the team already keeps things. For each domain: registrar, which account holds it, expiry date, renewal method, card on file, and who to call.

Most organisations discover during an outage that this document has never existed.

Monitor independently of the registrar

Here’s the argument in one line: the registrar is simultaneously the thing that can fail and the thing warning about the failure.

An independent watcher reads the registry record directly and has no shared dependency on the registrar’s billing system, mail server, or account settings. It’s a second alarm on a separate circuit.

That’s the job Domain Monitor Hub does — reading each registry’s own RDAP service, found through IANA’s official directory, and sending expiry reminders at 30, 14, 7 and 1 days, plus any custom intervals, set separately per domain.

Worth being precise about the limits: monitoring doesn’t renew anything and doesn’t prevent expiry. It removes the surprise, which is the part that turns a $12 problem into a $175 one.

Watch the other three clocks too

Expiry is one failure mode out of four:

• SSL certificate expiry — checked daily, well before the browser warning appears
• DNS record changes — A, AAAA, MX, NS and TXT, catching hijacks, accidental edits and mail breakage
• WHOIS changes — registrar or nameserver switches, a lifted transfer lock, or a status flipping to redemptionPeriod or pendingDelete

Managing more than a handful

For anyone looking after a portfolio rather than a single domain, the useful features are bulk import, per-domain notification groups, and a searchable alert history for when a client asks what happened and when.

Alerts reach owners by email and webhook on every plan, with Discord and Slack on the Pro and Business tiers — and notification groups decide, per domain, which channels each alert uses. Those larger tiers are still in development: the free plan covers three domains, and inside a free account the Subscription page carries a “Notify me at launch” button for the plans that aren’t out yet.

What if the domain is meant to go?

Sometimes letting a domain lapse is the right call. Doing it by simply not paying is not.

Abandonment keeps the liabilities

Stop paying, and the business loses control while keeping every downside: the mail still gets sent to it, the links still point at it, and whoever picks it up inherits the brand association.

The safe wind-down

1. Migrate every mailbox and confirm nothing important still routes there
2. Update the recovery address on every account that uses an address on this domain — this is the step that prevents a domain-resurrection takeover later
3. 301-redirect to the new domain for at least 6–12 months, ideally longer
4. Update SPF and DMARC on the destination domain, and remove any DNS callbacks pointing at the old one
5. Tell partners, clients and vendors in writing
6. Consider selling it — a domain with age and links has a market value that beats zero
7. Consider keeping it one more year purely as brand defence. A renewal is cheap next to a competitor or a spam network operating under an old brand name

Buying an expiring or expired domain

The other side of the same process.

Four routes in

• Registrar expired auctions — GoDaddy Auctions and equivalents, running from roughly day 26
• Backorders — a standing request to attempt registration the moment the domain drops
• Drop-catch services — DropCatch, NameJet, SnapNames and others, competing at the release instant
• Plain registration after the drop, which works only for names nobody else wanted

Due diligence before bidding

Expired domains carry history, and history transfers:

• Backlink profile — check for spam networks and paid-link footprints
• Wayback Machine — see what the domain actually hosted
• Trademark conflicts — a name matching an active brand is a lawsuit waiting to be filed
• Prior penalties — a domain can arrive with a manual action attached

Inherited risk

Mail keeps arriving for the previous owner, sometimes including sensitive material nobody wanted to receive. Blacklist entries follow the domain. Unresolved disputes follow it too.

Buying an expired domain means buying whatever the last owner did with it.

Emergency checklist: the first 24 hours

For anyone reading this with a domain already down.

1. Look up the current status via RDAP or WHOIS. Note the exact status code and the expiry date.
2. Check whether the domain is listed at auction. Search the registrar’s auction platform by name.
3. Identify the registrar and the account holding the domain.
4. Renew, or request a restore, immediately. Do not attempt a transfer first.
5. Confirm the payment actually cleared. A failed renewal attempt looks a lot like a successful one in a hurry.
6. Check the nameservers and re-point DNS if the registrar swapped them for parking.
7. Verify MX records and send test mail both directions.
8. Check SPF and DMARC survived the outage intact.
9. Reissue or re-validate the SSL certificate. Automated renewal almost certainly failed while the domain was dark.
10. Open Search Console, review crawl errors, request reindexing for key pages.
11. Re-enable auto-renew and update the card on file.
12. Move registrar notifications to an address that does not live on this domain.
13. Set an independent expiry alert so the next renewal isn’t a surprise.

Frequently asked questions

Key takeaways

• Expired is not deleted. For most gTLDs there’s a 65–80 day window, but the recoverable part shrinks and gets pricier at three checkpoints.
• Email dies first, and that mail is gone. Bounced messages aren’t queued anywhere.
• The auction overlaps redemption. A stranger’s bid can end the right to buy back a domain during a period most owners assume is protected.
• Recovery runs 10× the renewal price — $80–$250+ against a renewal in the low teens.
• The registrar is a single point of failure. Three required reminder emails, one inbox, one spam filter, one card.
• Country domains don’t follow the gTLD rule. Some are more forgiving, some far less, and a few publish no expiry date at all.