A renewal can lapse for an ordinary reason, such as reminders going to someone who has left or a card on file that has expired. ICANN's renewal FAQ says that if you want to keep using a domain and the services tied to it, such as a website or email, you need to renew it before it expires, or it may be released for someone else to register.

How a domain expires

For generic domains such as .com and .org, ICANN's Expired Registration Recovery Policy sets the minimum sequence. Registrars must send renewal reminders about one month and one week before expiry, and the policy's notes accept anything from 26 to 35 days and from 4 to 10 days before. If the name is neither renewed nor deleted, another notice must follow within five days after expiry.

A registrar may delete an expired name at any time, but first it must interrupt the name's DNS, to the extent the registry allows. Because DNS is what points the name at your website and email, both stop working. The interruption covers at least the last eight days the name can still be renewed, or the whole time from expiry to deletion if it is deleted sooner. If the registrar points the name at a web page meanwhile, that page must say the registration has expired and explain how to renew, and once you renew, the registrar must restore your DNS settings.

After deletion, a .com or .org name enters a 30-day Redemption Grace Period, during which the registrar that deleted it can still restore it, possibly for an additional redemption fee. If it is not restored, it spends five days in pending delete and is then released for anyone to register. Registrars must clearly display their renewal, post-expiration renewal and restore fees on their websites, so copy all three into your list.

Find where each domain lives

Start with your primary domain and record its registrar, account owner, expiration date and where renewal notices go. Then add every other name you pay for, including brand variations, old names that still redirect and any domain added to Microsoft 365 or Google Workspace. Google's Workspace help says to renew every domain in your account, and warns that if someone else buys your expired primary domain, you have to delete the Workspace account.

If you are not sure which registrar holds a name, ICANN's renewal FAQ points you to its lookup tool, now called ICANN Lookup. Microsoft's guide to the tool says the Registrar Information section names the registrar, and the Nameservers entry under Domain Information shows which company hosts your DNS, which can be a different company. ICANN's Registration Data Policy requires the public results to show the registrar, an expiration date and the status codes, but the registrant's name and contact details can be redacted, so confirm those inside the registrar account.

ICANN's guide to status codes explains what these mean:

  • clientTransferProhibited blocks transfers to another registrar, which helps prevent hijacking and fraud.
  • autoRenewPeriod means the registration period ended and the registry renewed it automatically, though the registrar can still delete it during this grace period.
  • clientHold keeps the domain out of DNS so it does not resolve, and is usually set during a legal dispute, for non-payment or when the domain is subject to deletion.
  • redemptionPeriod means the registrar has asked the registry to delete the domain, which stays in this status for 30 days.
  • pendingTransfer means a transfer to a new registrar is being processed, so contact your registrar immediately if you did not request one.

Put each domain in the organization's name

The registrant, which ICANN calls the Registered Name Holder, is the party the registration belongs to. The account owner is whoever controls the registrar login, and your list records both because they can differ. Under ICANN's Registration Data Policy, if you fill in the registrant organization field, that organization is considered the Registered Name Holder, so enter the organization's legal name and use a shared mailbox as the registrant email.

Keep that record accurate. Under ICANN's Registrar Accreditation Agreement, willfully giving inaccurate information, willfully failing to update it within seven days of a change, or failing for more than 15 days to answer the registrar's questions about its accuracy is a basis for suspending or canceling the registration. Registrars must also present your registration data for review at least once a year under ICANN's Registration Data Reminder Policy, so recheck the whole list when that reminder arrives.

If a domain sits in a former employee's or vendor's account, ask the registrar how it moves domains between accounts, or transfer the domain to a registrar where the organization has its own account. ICANN's Transfer Policy requires a registrar that does not offer self-service tools to give the registrant the transfer code, called the AuthInfo code, and remove the transfer lock within five calendar days of the registrant's request.

Order matters when the registrant changes too. A material change to the registrant's name or organization, or any change to the registrant's email address, counts as a change of registrant, after which the registrar must block transfers to another registrar for 60 days unless it let you opt out beforehand. If moving registrars is the goal, the policy advises requesting the transfer first. ICANN's Board adopted recommendations to revise the Transfer Policy in June 2026 without setting an effective date, so confirm the current rules with your registrar before you start.

Make notices and payments outlast staff changes

Send notices to an address more than one person reads. If your registrar lets you add a secondary email address, use one that is not on the domain itself; the best practices in ICANN's renewal policy suggest this so reminders can still be delivered after the domain expires. They also suggest that registrars publish the address their notices come from and recommend saving it as a safe sender, so a spam filter does not catch the reminder.

If you use auto-renew, keep the payment details current, as ICANN's FAQ advises. Check the renewal price too, because ICANN notes that promotions for new customers can make the first-year fee lower than the cost to renew. Registrations typically run one to ten years, and a longer term leaves fewer renewals to miss.

If you bought your domain from GoDaddy while signing up for Google Workspace, Google's help says the registration moves to a separate GoDaddy domains account, with migrations starting May 11, 2026. Google says you must then sign in to that account and enter billing information, even if the domain was set to auto-renew before. To find the sign-in details, open the Admin console and go to Menu, then Account, Domains, Manage domains and View Details.

Lock down every account that can change DNS

In a 2019 emergency directive, since closed, CISA described attackers who obtained the credentials for accounts that can change DNS records, used them to redirect and intercept web and mail traffic, and then obtained valid certificates for the targeted domains. It ordered federal agencies to put multi-factor authentication on those accounts, registrar accounts included, and recommended moving domains to a registrar that offers it.

Turn on two-step verification for every registrar, DNS and hosting login. Then ask your registrar which transfer, update and delete locks it can apply; ICANN's status code guide describes each one as a guard against unauthorized changes.

Add hosting and what depends on it

Do the same for hosting, noting whether the plan also carries your email or DNS. Microsoft's DNS basics guide explains that the nameservers determine where your DNS records are managed, and the MX record points to where your email should be sent. If your nameservers belong to the web host, the records that route your email live in that hosting account, so canceling the plan before moving DNS can take your website and email offline together.

When you retire a host or service, delete the DNS records that pointed to it. Microsoft's guidance on dangling DNS, written for its Azure cloud, explains that a leftover record can let someone else claim the deleted resource, serve their own content on your subdomain and even obtain a valid certificate for it.

Track certificates on a shrinking schedule

Add any certificate that renews outside your hosting platform, such as one installed by hand on a firewall or a separately hosted client portal. Certificates your host renews automatically still get a row, recording what renews them and who is alerted if renewal fails, rather than a date to act on.

Under the CA/Browser Forum's Baseline Requirements, publicly trusted TLS certificates issued on or after March 15, 2026 can last at most 200 days. The limit falls to 100 days for certificates issued from March 15, 2027, and to 47 days from March 15, 2029. A certificate renewed by hand therefore comes due about twice a year now, about every three months from 2027 and every six to seven weeks from 2029.

A manual renewal can also mean proving again that you control the domain. The same requirements let a certificate authority reuse that proof for at most 200 days, falling to 100 days from March 15, 2027, and to 10 days from March 15, 2029. One accepted method is placing a value the authority supplies in a DNS record, so note who can edit your DNS. Since March 15, 2026, authorities should not use the method that emails addresses such as admin or webmaster at your domain, and from March 15, 2028 they must not rely on it.

Do not rely on the certificate authority to remind you. Let's Encrypt, for example, has ended the expiration emails it announced would stop on June 4, 2025. With lifetimes shrinking, it says manual renewal is not recommended and advises monitoring that alerts you when a certificate is not renewed when expected. Put each manual renewal on a shared calendar with a few weeks' warning.

Public Certificate Transparency logs help find certificates nobody wrote down. The project's site says domain owners can see which authorities issued which certificates, when and for which domains, and its monitors page lists monitoring services, some of which email you when a new certificate for your domain appears. The same logs expose certificates you never requested, which is why CISA's directive told agencies to watch them.

What each row needs

Give each domain, hosting plan and certificate a row with:

  • Provider and account name
  • Account owner, ideally the organization rather than a person
  • For domains, the registrant named on the registration
  • Expiration date, renewal term and auto-renew status
  • Payment method, without the card number
  • Renewal and restore prices from the provider's published fees
  • Where notices go, including any secondary address
  • What depends on it, such as the website, email or DNS
  • Who can edit DNS or complete a certificate renewal
  • Whether two-step verification and registrar locks are on
  • Second authorized person
  • Vault entry holding the recovery instructions
  • Date last checked against the account

A worked example

Imagine a ten-person accounting office whose domain a former web designer registered years ago, in the designer's own registrar account, with every reminder going to the designer. ICANN Lookup shows the transfer lock is on and lists nameservers at the designer's hosting company, which means that hosting account also holds the MX records that deliver the firm's Microsoft 365 email.

The office manager asks the designer to move the domain into an account the firm opens at the same registrar. She then enters the firm's legal name as the registrant organization and a shared renewals mailbox as the registrant email, and both she and the designer confirm the change. Because the firm is staying with that registrar, the 60-day transfer lock that follows does no harm.

Next she adds a secondary notice address outside the firm's domain, saves the registrar's sending address as a safe sender, turns on auto-renew with a company card that is not about to expire, and turns on two-step verification. The hosting plan gets its own row, marked as also running DNS for email, so nobody cancels it without moving DNS first.

A Certificate Transparency search shows certificates for two names, the website and a client portal. The website's certificate renews automatically through the host, so its row names the host and the monitor that will flag a missed renewal. The portal's certificate was bought separately and installed by hand, and its authority confirms control through a DNS record that only the hosting account can edit. Under the 200-day limit it comes due about twice a year, so it gets a calendar entry 30 days before expiry, assigned to the office manager.

A partner is the backup. She signs in with her own account, finds every date, and compares the portal certificate's expiry in her browser with the row.

Common mistakes and how to spot them

Watch for these:

  • The registrar account belongs to a former employee or vendor. Their email address appears on the account profile and renewal receipts.
  • Notices reach one person, or only an address on the domain itself. The contact settings in each account show where they go.
  • Auto-renew is on, but the card behind it has expired. Each account's payment page shows the card's expiry month.
  • Two-step verification codes go only to one person's phone. Check that a second authorized person can sign in with their own method.
  • An old hosting plan is canceled while it still runs DNS or email. Check the nameservers in ICANN Lookup before canceling anything.
  • A certificate renewal fails after a change of certificate provider. A CAA record in your DNS names the authorities allowed to issue for your domain, and the Baseline Requirements oblige authorities to check it, so update it first.
  • A lookalike renewal notice gets paid. In a 2003 case, the FTC alleged that one company's mailings looked like renewal notices from recipients' current registrars, when paying actually moved the domain to another registrar, so pay only inside the account your row names.

Check the list against the accounts

Ask a second authorized person to find the renewal settings without using your credentials, ideally through their own sign-in. Store account recovery instructions in your approved password vault and keep passwords out of the spreadsheet.

Then confirm each expiration date and auto-renew setting in the provider's account, not from an old invoice, and check that ICANN Lookup shows the registrar, nameservers and status codes your row lists. Compare the certificate expiry date your browser shows for each site with your row, and send a test message to each notice address to make sure someone sees it.

If you use Microsoft 365, check your domains after any DNS change by going to Setup, then Domains, in the admin center and reading the Status column. If a domain shows an issue, choose Check health from its more actions menu for a description. Finally, test the alerts themselves by confirming that your certificate monitor covers every hostname in your rows, that its messages reach the shared address, and that manual renewals sit on a shared calendar.

What to do this week

Start with these:

  • Look up your primary domain in ICANN Lookup and note the registrar, nameservers and status codes.
  • Sign in to the registrar, confirm the expiry date, auto-renew, card and registrant organization, and turn on two-step verification.
  • Set a shared notice address and a secondary address outside the domain.
  • List each certificate installed by hand and put its renewal on a shared calendar.
  • Set up expiry monitoring for every public website and portal.
  • Have a second person find every date using their own sign-in.

Answers to common follow-up questions

An expired domain can usually still move to another registrar. ICANN's FAQ says registrars may not deny a transfer because a domain has expired or was not renewed, unless an earlier registration period went unpaid, but a name in the Redemption Grace Period must be restored by the current registrar before it can be transferred.

Missing reminders can be reported through ICANN's Domain Renewal Complaint Form, which also covers a renewed domain that still does not work and a name you could not redeem during its Redemption Grace Period. ICANN asks you to allow 3 to 5 business days for a response.

Paying more does not buy a longer certificate lifetime. The limits in the Baseline Requirements apply to every publicly trusted TLS server certificate, whatever it costs.

Country-code domains follow their own registry's rules. The ICANN policies above cover generic domains, while names such as .us, .ca and .uk are run by country-code managers, which IANA lists in its root zone database.

Where ALCO can help

ALCO's Domains and DNS service starts with an audit of every domain you own, covering where it is registered, who the registrant is, when it expires and what every record points at. Registrations are kept in your company's name with ALCO as the technical contact, auto-renew on and expiry dates tracked, and TLS certificates are issued and renewed automatically for every site and service ALCO manages. If an ex-employee or a former agency registered your domain, ALCO helps you get it back into the company's name. The help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources

  • FAQs for registrants on domain name renewals and expiration, ICANN - icann.org/…
  • Expired Registration Recovery Policy as updated in 2024, ICANN - icann.org/…
  • EPP status codes and what they mean for registrants, ICANN - icann.org/…
  • Transfer Policy as updated in 2024, ICANN - icann.org/…
  • Registration Data Policy for generic domains, ICANN - icann.org/…
  • Baseline Requirements for publicly trusted TLS server certificates, CA/Browser Forum - cabforum.org/…
  • Find your domain registrar and DNS hosting provider, Microsoft - learn.microsoft.com/…
  • Emergency Directive 19-01 on DNS infrastructure tampering, CISA - cisa.gov/…