An expired domain does not vanish at once. Registries run grace stages, including a 30 day redemption period for deleted domains, and the name is purged and open to registration after that. Your site and mail can still stop on day one, and final loss can hand your name to a stranger.
The sequence in plain terms
ICANN publishes explanations of the registration status codes that appear in a domain lookup. The ones that matter for expiry:
| Status | What it means |
|---|---|
| autoRenewPeriod | A grace stage after the registry extends a domain automatically when the registration period ends |
| redemptionPeriod | The registrar has asked the registry to delete the domain. It is held for 30 days |
| pendingRestore | The registrar asked the registry to restore a domain from redemption and must supply documents in time |
| pendingDelete | The redemption window has passed. The domain stays in this status for several days and is then purged |
ICANN states that after five calendar days following the end of the redemption period, the domain is purged from the registry database and becomes available for registration.
Exact timing before deletion differs by registrar and by top level domain. Your registrar may suspend DNS or park the domain on a placeholder page the day it lapses, even though the registry stage has not begun.
Why this is a security issue, not just an admin one
- Outage. Web, mail and every service using the name can stop working.
- Mail interception. Whoever registers the name after purge can receive mail sent to your old addresses. That includes password resets for accounts that used those addresses.
- Trust inheritance. Other systems may still trust the domain: allowlists, OAuth settings, package registry maintainer emails. We cover one case in expired maintainer domains in package registries.
- Redemption cost. ICANN's text says restoring a domain from redemption needs your registrar to act and an appropriate fee to be paid.
How to prevent it
- Auto renew on every domain, with a valid payment method held by the company.
- Renewal contacts that reach a shared mailbox, not one person. Keep that mailbox on a different domain.
- Calendar reminders two months ahead for each domain, independent of the registrar's email.
- One owner per domain recorded in an inventory with the purpose and renewal date.
- Multi year registration for domains central to the business, where your budget allows.
- Registry lock for the most critical, see registry locks.
If you let a domain go on purpose
Retire it deliberately. Remove it from every allowlist, SSO config and verification list first. Move any accounts that used addresses on it to a different email. Think about whether the name is worth holding for a defensive reason, since a released name can be registered by anyone, including people who wish to impersonate you. For a name you keep but do not use, publish records that stop spoofing.
If it already expired
- Contact your registrar at once and ask the status of the domain.
- Ask what is needed to renew or restore, and the cost.
- Do not wait for a reminder email. Redemption is time limited.
- Once restored, check the DNS records and contacts are intact, and consider whether anyone changed anything during the lapse.
Safeguard works on the software supply chain side, including SBOM and dependency scanning. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Can anyone register my domain the day it expires?
Generally no. Registries hold a domain through grace and redemption stages first, but your registrar may disable the site and mail much earlier.
Does auto renew guarantee I keep the domain?
No. A failed payment, an expired card or a notice sent to a dead mailbox can still lead to expiry. Keep payment and contacts current.
Sources
Last reviewed: 19 October 2026.
