When your domain expires, everything attached to it stops

The card on file at the registrar expired in the spring. The renewal failed, the reminder went to an inbox nobody checks, and one morning the website is a page in the registrar's colours that says the domain has expired. Email has stopped arriving. Somebody's phone shows the shop's Google sign-in asking for a verification code that has nowhere to go.

The name reached its date, and the registrar did what the rules require it to do; there is no intruder to look for. This article is about those rules, as written for the ordinary endings such as .com, .net and .org, in a policy ICANN publishes for its registrars. Country endings like .de, .es or .co.uk run on their own clocks, some of them shorter, and are outside it. Everything quoted comes from pages I read on 12 September 2026.

The registrar is required to switch you off

The interruption is written into the policy every accredited registrar works under. ICANN's Expired Registration Recovery Policy, in the version dated 21 February 2024, says of names deleted eight or more days after expiry:

"For at least the last eight consecutive days (after expiration) that the registration is renewable by the RAE, the existing DNS resolution path specified by the RAE must be interrupted by the registrar to the extent that the applicable registry permits such interruptions."

ICANN, Expired Registration Recovery Policy, section 2.2.3

"RAE" is the policy's word for you, the person who was entitled to renew. "Resolution path" is the set of answers the name gives to the internet: which server hosts the site, which one takes the mail. The registrar must replace those answers with its own, and if it sends visitors to a page, section 2.2.4 says that page "must conspicuously indicate that the domain name registration is expired and provide renewal instructions".

ICANN's own plain-language page explains the purpose: interrupting the name "means that all the services associated with the domain name (such as websites and email addresses) may stop working. This may alert you that a domain name has expired and must be renewed." The outage is the alarm, by design. The eight days are a floor, counted back from deletion, and the policy lets registrars delete registrations "at any time after they expire".

The notice goes to a mailbox on the domain

The policy requires warnings around the date: at least two before it, "approximately one month prior to expiration and ... approximately one week prior", and one more "within five days after the expiration". They go to the addresses the registrant supplied, and those are often on the domain itself. In the notes attached to the policy, ICANN's own policy body writes:

"If the post-expiration notifications described in paragraph 2.1.2 are normally sent to a point of contact using the domain in question, and delivery is known to have been interrupted by post-expiration actions (such as an interruption of DNS resolution, as described in paragraphs 2.2.2 and 2.2.3), post-expiration notifications should be sent to some other contact point associated with the Registered Name Holder if one exists."

ICANN, Expired Registration Recovery Policy, "Suggested Best Practices"

The passage says "should", and it sits under the label "Suggested Best Practices", introduced by the words "The GNSO recommends", so a registrar that keeps sending to the dead mailbox is still within the policy. Namecheap, for one, sends reminders "to two email addresses (if they are different)", the account address and the registrant address; if both are on the domain, the notice that follows expiry goes to a mailbox that expiry has already switched off. The result is the one owners keep describing: website and email both down, including the very address the registrar has on file for them.

What stops with the name

The website is the visible loss and the smallest one. Namecheap's page on expired domains lists the rest: after expiry "the respective website and email service cease to work". And "all emails that are subsequently sent to your domain name-based email address will be lost." Mail sent in the meantime goes nowhere, and nothing holds it for the day the name comes back.

Mail goes first. Google's Workspace help says that if the registration lapses, "some Google Cloud services, such as Gmail, will stop working", and that a new owner can reset the records that route your mail.

Then the quieter dependencies. A website certificate keeps working until its own date. Its next renewal cannot pass, though: Let's Encrypt proves you control the name by fetching a file from your server or reading an entry the name publishes, and both now point at the registrar. Any system that calls your domain gets the registrar's answer instead, a payment processor sending order notifications to a webhook address on it, for one. That is the failure described in orders stopped arriving, and the other end stopped calling. And every account registered to an address on the domain, including the Google account that staff sign in with, has lost the mailbox that receives its recovery links. That last consequence is my reasoning; no vendor page I read spells it out.

In a 2017 settlement, the US Federal Communications Commission described a relay service for deaf callers whose "domain registration was deactivated" on 6 June 2016 after the company "failed to renew its domain name". Calls routed through the domain, "including VRS, 911, Dial-Around, and Point-to-Point calls", failed, and service "was not fully restored until June 8". The company agreed to pay $2.7 million to a relay fund and a $252,000 penalty.

Which of your systems depend on the domain resolving is a list most businesses have never written, and drawing it up is one of the things a process audit does.

The clocks after expiry, and who sets the price

What follows expiry is a sequence with the registrar's discretion at every step, and ICANN's one-page complaint sheet sets it out. First an auto-renew grace period, marked "Optional", that runs "0 to 45 days after expiration during which your registrar may allow you to renew". Then, once the registrar deletes the name, a mandatory 30-day Redemption Grace Period, during which the registry, the body that runs the ending itself, must "disable DNS resolution" under the policy, and the name, in the sheet's words, "may be restored, subject to redemption fees". Then five days of pending delete, after which the name "will be available for re-registration". Namecheap puts the typical total at "approximately in 70-80 days", and notes the name "may be auctioned off" instead.

ICANN's complaint form states plainly that "ICANN does not set renewal or redemption fees"; section 4.1 of the policy requires only that registrars make them "reasonably available ... at the time of registration". After the name is released, the price is whatever the market says - and for a name somebody else wanted, the market's price after a failed autopay is routinely in the thousands.

Where this leaves you

Three questions. None of them needs a technical person.

Whose card is the domain on, and when does the card expire? A renewal that fails silently is the start of every story above. The registrar login belongs on the same page as the other things your business runs on somebody's personal account, the subject of whose accounts your automation runs on.

Which address receives the registrar's notices? If the answer ends in your own domain, change the registrant address to one that does not.

What is attached to the name? Mail, the site, its certificate, the webhook addresses your processors call, the sign-ins that recover through your mailbox. A register of what is automated with a column for "stops if the domain stops" is the cheap way to find out.

If you would rather have that list drawn up for you, with the renewal dates and the addresses the warnings go to, that is part of the process audit. $299, three business days, and a written map you keep whether or not you hire us.

Nothing here is legal advice.