An expired domain is a business risk, not an IT problem

A domain does not expire and then quietly wait for you. It moves through a fixed sequence of registry states, each with different rights attached, and at the end of that sequence anyone in the world can register it.

The sequence

After the expiry date, most registrars keep the domain in a grace period during which you can renew at the normal price. When that ends, the domain enters redemptionPeriod — a registry-level state lasting 30 days, during which only the original registrant can recover it, and only by paying a redemption fee on top of renewal, typically in the region of 80 to 120 US dollars.

When redemption ends, the domain enters pendingDelete for five days. Nothing can be done during pendingDelete. At the end of it the name drops and becomes available to anyone — and expired domains with existing inbound links are actively hunted by drop-catching services.

What breaks beyond the website

Email is the one that surprises people. If the company’s addresses are on the domain, every one of them stops resolving. Invoices bounce. Password resets for other services fail. Anything printed with the address becomes wrong.

Then there is the credibility cost, which is harder to quantify and easy to underestimate. A supplier evaluating you clicks the address in your signature and receives nothing.

How to check where a domain actually stands

Registrar dashboards are not always current. The registry is. For a .com, RDAP gives the authoritative status and the timestamps: the domain’s status codes, and the lastChanged event that tells you when it entered its current state. From that date, redemption is 30 days.

What to do about it

• Register the domain in the company’s name, never a supplier’s or an individual employee’s
• Set auto-renew, then verify the card on file has not expired — a lapsed card is the most common cause of a lapsed domain
• Register for multiple years; a domain that has lapsed once should not be on a one-year clock
• Put the expiry date in a calendar independent of the registrar’s own reminders
• Keep registrar account access with at least two people

None of this is difficult. It is simply nobody’s explicit job, which is exactly why it happens.