Domain expiration: what stops, and when

When a domain name expires, everything that depends on it stops: the website no longer loads and email addresses on the domain stop receiving mail. The name can be recovered for a few weeks, then anyone can register it.

Domains rarely expire because someone decided to let them go. They expire because a card, a contact address or an account was out of date. The expiration date is the first thing our domain and email audit reads from the registry.

Your website and email stop together

You do not buy a domain name: you rent the right to use it for a set term, from one to ten years depending on the extension. When the term ends without a renewal, the registrar (the company you registered the domain with) stops pointing it at your servers.

The website can no longer be reached, even though your hosting works and is paid for. Email sent to your addresses no longer arrives. Neither do password reset links sent to those addresses for your accounts with your providers.

After expiration: a few weeks, then the name is gone

For generic extensions such as .com, ICANN rules require the registrar to send two reminders before expiration, about one month and one week ahead, then a third within five days after. Once the domain is deleted, a 30-day redemption grace period lets you restore it, followed by five days before it becomes available again.

For .fr, the registry, Afnic, sets the same 30-day period after a deletion request. After that, the name goes to whoever asks for it first.

Once released, a name can be registered by anyone, and it still receives the visits and email meant for you.

Why renewals fail

Most registrars offer auto-renew. It fails for organizational reasons, rarely technical ones:

The card on file expired or was replaced. The charge fails, and the warning goes to the contact address.
The contact address belongs to a former employee, a former partner or the agency that built the site. The reminders arrive, and nobody reads them.
The contact address is on the domain itself. The reminder sent after expiration never arrives, because email has already stopped.
The domain was registered in the agency's or contractor's name, on their account. Its renewal then depends on an invoice, a contract or a relationship that may have ended.

The transfer lock, the other setting to know

The transfer lock is a status set on the domain, "clientTransferProhibited" in ICANN's status codes. It tells the registry to reject any request to move the domain to another registrar until you lift it.

It does not protect against expiration. It protects against hijacking: without it, someone who gets hold of the domain's transfer code can request a transfer to an account they control.

What we find on the sites we audit

15%had a domain name expiring in less than 90 days at the time of the audit

This percentage covers about 20 websites we audited between August 14, 2026 and September 24, 2026, the ones where this point could be checked. Many were audited because a defect showed up quickly, so the figure describes our audits, not websites in general.

A domain renewed every year goes through this window every year, so this figure does not mean those domains were about to expire. It shows how many were in the period where a missed renewal turns into an outage.

What the audit looks at

The audit reads the expiration date published by the extension's registry and counts the days left. Three thresholds apply:

Under 180 days: the point is noted, which leaves six months to check the account and the payment method.
Under 90 days: the report highlights it in a callout.
Under 15 days, or already expired: the pillar score and the overall score are capped, because the whole website's continuity is at stake.

The report also states whether the transfer lock is set.

The same pillar reads what protects your email from spoofing. The guide on DMARC, SPF and DKIM explains what these records ask of your recipients' mailbox providers.

What is quick to fix, and what takes a project

Renewing for several years, checking the card, and replacing the contact address with a shared, monitored address outside the domain in question: all of this is done once, in the registrar account.

When the domain is in an agency's name or on its account, it is a project. Changing the registrant or the registrar requires their cooperation, so it is best done while the relationship lasts. It is also worth checking before buying a business or its website.

What this check doesn't tell you

We read the date published by the registry. Auto-renew cannot be seen from the outside: a domain close to expiration may renew tomorrow with nothing changing on your side.

We also cannot see the actual registrant when their details are redacted, nor the contact address or the payment method. Those are the points to check in your account.

By Quentin Mathis, Z29K · updated September 28, 2026