When a domain expires, revenue usually stops before anyone in finance notices. Domain expiry incidents take down checkout pages, mail delivery, API endpoints and login flows together, and the cause is often an outdated credit card or a renewal notice sent to someone who left the company. This article covers how these incidents happen, what they cost and how to keep a forgotten renewal from becoming a public outage.
How Domain Expiry Incidents Actually Unfold
A domain doesn’t go offline the moment it expires. For gTLDs like .com and .net, there is a sequence of stages, and the behaviour at each stage depends on the registrar.
ICANN’s Expired Registration Recovery Policy (ERRP) requires registrars to send renewal reminders about one month and one week before expiry, and one more within five days after it. After the expiry date, most registrars offer a renewal grace period of 0-45 days. Next comes a 30-day Redemption Grace Period, where recovery fees often run $80-250 on top of the renewal price. A 5-day Pending Delete phase follows, and then the name is released to the public, where drop-catching services are waiting.
The part that hurts revenue is this: many registrars change the nameservers to a parking page as soon as the domain expires. Your zone is still there, but nothing on the internet is querying it anymore.
Myth: The Grace Period Keeps Your Site Running
A common belief is that the grace period gives you a month of normal operation to fix things. It doesn’t. The grace period protects your ownership of the domain, not your traffic.
Once the registrar points the domain at its parking servers, resolvers begin returning the parking IP as soon as their cached NS records time out. Parent-zone NS TTLs for .com are 48 hours, so the outage spreads unevenly. Some customers can reach the site and others land on a page full of ads. This often costs the first several hours, because the on-call engineer sees healthy origin servers and green load balancer checks and starts looking in the wrong places.
What Domain Expiry Costs in Real Revenue
Take an online store doing $1.2 million a year, or about $3,300 a day. If its primary domain lapses on a Friday evening and someone notices on Monday morning, roughly $10,000 in direct sales is gone. Lost sales are usually the smaller part of the bill, though.
Email breaks too. MX records stop resolving, so order confirmations, password resets and supplier invoices bounce or disappear. SPF, DKIM and DMARC lookups fail, so after recovery some receiving providers apply stricter filtering for a while. Paid ad campaigns keep spending on Google Ads and Meta while sending clicks to a parking page. Payment provider webhooks fail and may need to be replayed by hand. If search crawlers hit the domain during the outage, rankings can take 2-6 weeks to fully recover.
There are also public examples. In July 2017, Marketo let marketo.com expire, and its customers’ email tracking links and forms broke until a third party renewed the domain for them. The total cost was never disclosed, but every customer whose campaign links failed that day had a reason to rethink the vendor relationship. The true cost of DNS downtime almost always goes beyond the hours of the outage itself.
The Hidden Expiry Risks Beyond Your Main Domain
Teams usually watch their main .com. The bigger risks tend to be the secondary domains.
The worst case is a nameserver domain. If your zones are served from ns1.examplecorp-dns.net and that domain lapses, every zone it serves goes dark together. Worse, an attacker who registers the dropped name controls DNS answers for every domain that still delegates to it.
Next are the domains behind your CNAMEs. A tracking domain, a link shortener or an old CDN hostname that your subdomains point to can expire without anyone noticing. That leaves dangling DNS records pointing at names anyone can register. Retired email domains are a quieter risk: if staff once used an old brand domain for SaaS logins, whoever registers it can receive password reset emails for those accounts.
Common Mistakes That Lead to Domain Expiry Incidents
The first mistake is trusting auto-renew without checking the payment method. Corporate cards get reissued every 3-4 years, after fraud events and during finance system migrations. Auto-renew fails without much noise, and the warning goes to an inbox nobody reads.
The second is tying the registrar account to a person instead of a role. When the contact address is a former employee’s mailbox, the ERRP reminders go nowhere. Use a shared alias like domains@ with at least two owners.
The third is keeping track of renewals only in a spreadsheet. The spreadsheet records what someone remembered to add. It won’t include the domain marketing registered on a personal card for a 2022 campaign, or the domains that came with an acquisition.
Step-by-Step: Preventing Expiry Before It Happens
An experienced DNS administrator treats renewal as a monitored control, not a calendar reminder. A workable process looks like this:
1. Build a complete inventory by pulling every domain from every registrar account, then cross-check it against NS and CNAME targets in your zones. That catches domains you depend on but didn’t know you owned.
2. Set renewal terms of 2-5 years for the main domain, nameserver domains and anything tied to revenue, so a single missed payment can’t take them down.
3. Turn on registrar lock and, where available, registry lock. Read up on registrar lock settings and emergency recovery before you need them.
4. Monitor expiry dates through WHOIS or RDAP, with alerts at 90, 30 and 7 days, sent to a channel the on-call team actually reads.
5. Check NS delegation for each domain and alert right away if the nameservers change to anything outside your known set. That is the first visible sign that the registrar has parked an expired domain.
Edge Cases Where Standard Advice Breaks Down
ERRP covers only gTLDs. Country-code TLDs follow their own registries’ rules. Nominet’s .uk domains are suspended after expiry and cancelled after 90 days, and some ccTLDs have almost no grace period. Organisations with regional storefronts on .fi, .de or .com.br should check each registry’s policy rather than assume the gTLD timeline applies.
Regulated industries face another problem. Under PCI DSS or a banking regulator, an expired payment domain can be a reportable incident, not just an outage. Small teams of fewer than 10 people are at the highest risk, because one founder’s personal registrar account often holds everything. For them, moving to a shared business account matters more than any monitoring tool. A portfolio review before renewal deadlines is a practical place to start that cleanup.
FAQ
Can I recover a domain after it expires?
Usually, yes, as long as it hasn’t reached Pending Delete. During the renewal grace period it costs the normal renewal price. During the 30-day redemption period, expect an extra fee of roughly $80-250. Once the domain is released, anyone can register it.
How long does a site stay down after an expired domain is renewed?
Resolution recovers as cached NS records expire. That typically takes a few hours, but it can take up to 48 hours for .com because of parent-zone TTLs. Email deliverability and search rankings can take several weeks to return to normal.
Is auto-renew enough to prevent domain expiry?
No. Auto-renew fails when a card expires, when an account has no funds or when registrar accounts are migrated. Independent monitoring of expiry dates and NS delegation is what catches the failures auto-renew doesn’t warn you about.
Final Practical Tip
Take 30 minutes this week to list every domain that appears as a nameserver, a CNAME target or an email domain in your zones, then check who pays for each one and when it expires. Most domain expiry incidents come from the one domain nobody remembered owning, not from the main brand domain. Multi-year renewals, role-based contacts and automated alerts on expiry dates and NS changes together turn a possible weekend of lost revenue into a routine ticket.