Domain Expiry Checker

Q: What is a registrar lock?

A registrar lock is the clientTransferProhibited status. It blocks transfers of the domain to another registrar until you remove it in your account. It protects against hijacking through a stolen registrar login or a social-engineered transfer request. Most registrars let you turn it on for free. Some country-code registries, such as .de, don't use this status, so the checker shows the lock as not published.

See when your domain registration expires, and check the domains your email depends on: SPF includes, mail servers, name servers and DMARC report addresses. One lapsed domain can take your email down or hand it to an attacker.

How the Domain Expiry Checker Works

The checker reads registration data straight from the domain registry, so you see the same expiry date the registry holds. With dependency checking on, it also finds the third-party domains your mail flow relies on and checks them too.

Enter your domain

Type a domain like company.com, or open "Check several domains" and paste up to 20. Subdomains and URLs are reduced to the registered domain.

Dependencies are found

We read your SPF, MX, NS and DMARC records from public DNS and collect the domains they point to, such as include: vendors, mail hosts, DNS providers and rua report addresses.

Expiry is checked

Each domain is looked up in its registry's RDAP service. You get the registrar, registration and expiry dates, days left, EPP status codes and registrar lock, plus a list of what to renew or fix first.

Why Domain Expiry Matters for Email Security

An expired domain is more than a renewal reminder you missed. It breaks your website and mail at once, and anyone can register the name after it is released.

Website and email outage

When a domain lapses, the registrar usually removes its DNS or points it to a parking page. Your site goes offline, inbound mail bounces and SPF, DKIM and DMARC stop resolving, so outbound mail fails authentication.

Your mail goes to someone else

Drop-catch services register expired domains within seconds of release. The new owner can set up MX records and receive mail sent to your old addresses, including password reset emails for accounts tied to them.

Vendor domains are a takeover path

If a domain in your SPF include: or MX records expires, whoever registers it can authorize their servers to send as you or receive your mail. Those messages can pass SPF and DMARC.

Read: dangling DNS and takeover →

What Happens When a Domain Expires

A domain is not deleted on its expiry date. It moves through several stages, and your options shrink at each one. The bar below shows the typical stages for a gTLD like .com, to scale.

Auto-renew grace · 0–45 daysGrace · 45 d Redemption · ~30 daysRedemption · 30 d 5

Expiry dayReleased (up to ~80 days later)

Day 0

Expiry day

The registration period ends. Many registrars park the domain or stop its DNS within days, which takes down your website and email.

0–45 days

Auto-renew grace

You can still renew at the normal price. The length depends on your registrar, and some give no grace period at all.

~30 days

Redemption period

The domain is removed from DNS. Only the previous owner can restore it, and registrars charge a restore fee on top of the renewal.

5 days

Pending delete

The domain can no longer be restored by anyone. The registry deletes it at the end of this period.

Released

Open to anyone

The name returns to the public pool. Drop-catch services often register domains with traffic or mail history the moment they are released.

Typical values for generic TLDs. Registries and registrars set their own periods, and many country-code TLDs follow different rules.

How to Prevent Domain Expiry

Turn on auto-renew

Enable auto-renew for every domain you own, including old brand and campaign domains that still receive mail.

Keep billing and contacts current

Auto-renew fails on an expired card. Use a shared mailbox like domains@ as the registrant contact, not one person's inbox.

Add a registrar lock

Turn on clientTransferProhibited so the domain can't be moved to another registrar without unlocking it first.

Monitor expiry dates

Track your domains and the vendor domains in your SPF and MX records. Set up domain expiry monitoring to get alerts before they lapse.

Frequently Asked Questions

How do I check when my domain expires?

Enter the domain above and run the check. The expiration date comes straight from the domain's registry, along with the registrar, the EPP status codes and the transfer lock. To renew, or to turn on auto-renew, use your registrar account.

What is RDAP and how is it different from WHOIS?

RDAP (Registration Data Access Protocol) is the replacement for WHOIS. It returns registration data as structured JSON over HTTPS, with standard fields for dates, registrar and status codes. WHOIS returns free text that differs by registry. ICANN requires RDAP for all generic TLDs and many country-code registries run it too, so this checker reads the dates from each registry's own RDAP service.

Why do some domains show no expiry data?

Some country-code registries, such as .eu and .jp, don't run an RDAP service, and others, such as .de and .ch, don't publish expiry dates at all. For those, check the date in your registrar account. A domain that doesn't exist in DNS is still flagged, even when its registry has no RDAP service.

Why does the expiry date look a year later than I expected?

Registries for .com, .net and some other gTLDs renew the domain automatically on its expiry date and bill the registrar. If you don't pay, the registrar can still delete the domain during the auto-renew grace period, up to 45 days. A date one year ahead doesn't prove the renewal was paid, so confirm it in your registrar account.

Why check domains my email depends on?

Your SPF record, MX records, name servers and DMARC report addresses point to domains owned by vendors. If one of those expires and someone else registers it, they can send mail that passes SPF for your domain, receive your mail, control your DNS or read your DMARC reports.

What is a registrar lock?

A registrar lock is the clientTransferProhibited status. It blocks transfers of the domain to another registrar until you remove it in your account. It protects against hijacking through a stolen registrar login or a social-engineered transfer request. Most registrars let you turn it on for free. Some country-code registries, such as .de, don't use this status, so the checker shows the lock as not published.

Is the domain I check stored?

We don't keep a record of the domains you check. To run the check, the domains are looked up in public DNS (Google, with Cloudflare and Quad9 as backups) and in each registry's public RDAP service. A result is held for about five minutes so a repeat check is instant, and a registry's answer for up to 15 minutes. Then both are discarded.

Never lose a domain or a mail route to expiry

PowerDMARC monitors your domains, DNS records and email authentication in one place, and alerts you before registrations lapse or records break.

Book a demo Start 15-day trial