Domain expiry monitoring

A domain registration expiry is categorically different from an SSL certificate expiry. When an SSL certificate lapses, browsers show a warning but the domain remains under your control — the fix is a certificate renewal. When a domain registration lapses, you lose control of the domain entirely. DNS stops resolving, your website goes offline, email stops delivering, and your SSL certificates become irrelevant because the domain no longer points anywhere. In most registrars, a lapsed domain enters a redemption period and is then released to the open market, where anyone can register it — including competitors or bad actors who want to exploit your existing backlinks, email reputation, or user trust.

Domain expiry monitoring reads registration data via WHOIS and RDAP lookups and tracks the expiry date for each configured domain. Unlike SSL certificates — where you probe the live certificate on port 443 — domain registration data comes from the registrar's records, independent of whether a web server is running. This means domain expiry monitoring catches risks that neither uptime monitoring nor SSL monitoring can detect: a domain that is about to lapse even though the website is currently serving fine.

Staged alerts at 60, 30, 14, and 7 days before expiry give your team time to act through normal renewal processes rather than emergency escalation. The 60-day mark is the first signal to check your registrar auto-renewal settings and payment method. The 30-day mark is when to initiate a manual renewal if auto-renewal is not configured. The 7-day alert is the final escalation: if renewal has not happened by this point, someone needs to log into the registrar immediately. Each threshold fires exactly once — idempotent delivery avoids alert fatigue.

Registrar renewal reminders are not a substitute for independent monitoring. Registrar emails go to the account email on file — often a former employee, a shared alias that nobody reads, or a personal email from whoever originally registered the domain. They are also sent from the same registrar that sends routine marketing email, which means they frequently get filtered or ignored. Independent monitoring sends alerts to your current on-call channels — Slack, PagerDuty, the infrastructure team's email — through the same configuration as your other production alerts.

Domain portfolios grow organically and become hard to track manually. The main domain is easy to remember. The defensive registrations — the .net and .io variants, the country-code TLDs for markets you entered last year, the hyphenated version you registered to prevent squatting — are the ones that get forgotten. A domain monitoring system that covers the full portfolio surfaces the forgotten ones before they lapse, without requiring anyone to remember the full list.

Multi-TLD support covers all major generic TLDs (.com, .net, .org, .io, .co, .dev) and country-code TLDs (.fr, .de, .uk, .ca, .au, .jp, and more). WHOIS data availability varies by TLD registry — some registries restrict automated WHOIS lookups. CertFleet uses both WHOIS and RDAP (the modern replacement for WHOIS, with structured JSON responses) to maximise data availability across TLDs.

Domain expiry monitoring complements SSL certificate monitoring and DNS monitoring to give complete domain health coverage. An SSL certificate expiry is recoverable in minutes. A DNS misconfiguration can be corrected at the registrar in seconds. A domain registration lapse can take days or weeks to resolve — if it is recoverable at all. Monitoring all three layers independently ensures you always have advance warning where intervention is still straightforward.