How to check domain registration expiry

When you check domain expiry date at the registrar, you learn when the name itself lapses—not when the TLS certificate expires. Confusing the two causes preventable renewal and validation failures.

Finance and IT owners need registrar expiration for budgeting and compliance, while engineers monitor notAfter on certificates. A domain can have valid HTTPS until tomorrow while registration already entered the redemption period, or the opposite: years of paid registration on a host serving an expired cert.

This guide walks through RDAP-first lookups, legacy WHOIS fallbacks, and how to document results next to TLS checks so runbooks stay clear.

Procurement teams often own registrar accounts while engineering owns Kubernetes. Without a shared check domain expiry date ritual, renewal invoices sit in an unmonitored mailbox until DNS suddenly stops resolving during a product launch. RDAP gives machine-readable dates that finance can import without copy-pasting WHOIS prose into spreadsheets.

Mergers multiply registrars: .co.uk, .de, and .com may sit in three portals with different auto-renew flags. Centralizing RDAP polling per registrable domain catches the parent record even when brand teams only remember marketing subdomains.

What to check

Registrar domain expiration (sometimes labeled expiration or registry expiry) is the contractual end of the registration. TLS certificate expiry is cryptographic and independent—see OpenSSL check certificate expiry date. Auto-renew flags at the registrar matter: expiration dates in RDAP may already reflect a paid-forward period.

Also note transfer lock, registrar hold, and DNSSEC status; they do not change expiry directly but block fixes near the deadline. For ccTLDs, fields differ; always read the full RDAP events array rather than one free-text WHOIS line.

Compare registry expiry versus registrar quoted expiry when resellers sit in the middle. If they disagree, escalate with the reseller support before assuming automation is wrong.

Step-by-step

Prefer RDAP (structured JSON). Use WHOIS only when RDAP is unavailable for a given TLD.

RDAP lookup (generic)

curl -s -H "Accept: application/rdap+json" \
  "https://rdap.org/domain/example.com" \
  | jq '{domain: .ldhName, events: [.events[] | {action: .eventAction, date: .eventDate}], status: .status}'

IANA bootstrap to pick the right RDAP server

curl -s "https://data.iana.org/rdap/dns.json" \
  | jq -r '.services[] | select(.[0][] == "com") | .[1][]' | head -1

Then query the registry RDAP URL for your TLD (details in RDAP lookup domain expiration).

WHOIS fallback when RDAP fails

whois example.com | grep -iE 'expir|paid-till|registry expiry'

On Windows without native WHOIS, use an RDAP web client or curl to the registrar API you control—avoid scraping fragile HTML.

Record alongside TLS for the same brand

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -dates

Store registrar expiry and TLS notAfter in the same ticket template so on-call never merges unrelated incidents.

Bulk list from a domain portfolio file

while read -r d; do
  exp=$(curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/$d" \
    | jq -r '.events[] | select(.eventAction=="expiration") | .eventDate' | head -1)
  echo -e "$d\t$exp"
done < domains.txt

Throttle requests; registries may rate-limit aggressive loops.

How to read the output

In RDAP, look for eventAction values such as registration, expiration, last changed, and sometimes reregistration. The expiration event’s eventDate is usually ISO 8601 UTC—convert for local procurement calendars.

status values like clientTransferProhibited are normal hardening; pendingDelete or redemptionPeriod mean urgent action. WHOIS text varies by registry (“Registry Expiry Date”, “paid-till”, “Expiry Date”); do not parse with a single regex across all TLDs.

If DNS answers but RDAP shows near-term expiry, expect DNSSEC or glue failures after deletion—not instant HTTPS errors. If HTTPS fails while RDAP looks fine, the problem is almost certainly TLS or DNS configuration, not registration.

The registration event date helps you prove how long a domain existed during trademark disputes; it is unrelated to TLS renewal but often sits beside cert tickets in shared inboxes. When multiple expiration-like events appear, read RDAP descriptions carefully—some registries emit both registrar-managed renewal dates and registry authoritative cutoff timestamps. Your procurement spreadsheet should store the stricter of the two with a footnote citing RDAP field names.

WHOIS fallback output may list updated date fields that reflect contact edits, not billing cycles. Train analysts to highlight only lines containing expiry semantics and to ignore last-modified timestamps that confuse executives during board reviews. Screenshots of registrar portals still help when RDAP redacts renewal windows for certain ccTLDs; attach portal PDFs to tickets even when automation succeeded.

When correlating RDAP with TLS output, plot both dates on a single timeline slide. Visually separated curves prevent the classic mistake of renewing a certificate while the domain itself is in redemption. If TLS expires first, engineering leads; if registration expires first, legal or IT procurement leads—mixed incidents need both leaders on the bridge call.

Common mistakes

Assuming Let’s Encrypt auto-renew protects the domain name—it only renews certificates while DNS and registrar data stay valid. Teams discover registration lapsed during ACME dns-01 or email validation.

Copying WHOIS privacy contacts into escalation lists delays renewal notices. RDAP often redacts registrant data but still shows registrar and technical contacts worth monitoring.

Checking only the apex when the failing hostname is a subdomain: subdomains inherit registration through the parent; expiry is still at the parent registrable domain.

Waiting until 30 days for high-value domains: many registries enter auto-renew or redemption windows with fees. Finance needs 60–90 day visibility, especially for country-code domains with manual paperwork (WHOIS expiration date alternative covers parser gaps).

Treating CT log searches as registrar data—Certificate Transparency shows certs, not registry billing (certificate transparency logs search).

Parsing WHOIS registrar fields from scraped HTML breaks when registries redesign portals. RDAP JSON schemas version slowly; prefer them in automation and reserve WHOIS for human spot checks when RDAP returns atypical status codes.

When to use automation

Registrar portals lie by omission when portfolios sprawl across brands. Automate daily RDAP expiration polling for every registrable domain in your asset inventory, with separate alerts for 30/14/7-day registrar thresholds and independent TLS notAfter thresholds.

Integrate finance so auto-renew failures page owners, not only DNS admins. After acquisition, bulk-import domains from spreadsheets through the same RDAP job—do not trust legacy WHOIS exports.

External services can combine live TLS with RDAP expiry in one dashboard (ssldays-style free checks) so a single report shows whether the risk is cert, name, or both. Re-run after transfer between registrars because event dates shift when sponsorship changes.

Maintain a domain risk register column for “registrar portal verified” separate from RDAP polling. RDAP can lag hours after a manual renewal; operators should mark human confirmation when payment clears.

Document ccTLD quirks in internal wiki pages linked from your RDAP scripts. Some country registries publish expiration only through national RDAP servers with language-specific status tokens—translators on the IT team prevent misreading “pending delete” as cosmetic.

During vendor transitions, export both TLS and RDAP snapshots weekly until the new registrar appears consistently in events. Escalate when last changed dates move without a matching ticket—unauthorized transfers are rare but catastrophic.

Train helpdesk staff to collect RDAP JSON for the apex when users report “site down” after long weekends. A five-second lookup distinguishes registration lapse from certificate expiry and routes tickets to the correct on-call rotation on the first touch.

Vendor management reviews should include registrar SLA clauses for RDAP availability, not only portal uptime. If automation cannot read expiration events during registry maintenance, secondary human checks must exist in runbooks with named owners and telephone escalation paths printed on laminated quick reference cards.

International subsidiaries sometimes register local ccTLDs through agents who resist API access. In those cases, store agent email threads confirming renewal dates in the same ticket as RDAP snapshots so auditors see human confirmation when machine readability fails.

Student and nonprofit discounts on domains renew at different price tiers; finance spreadsheets should track renewal cost alongside expiration dates to avoid surprise budget shortfalls that block auto-renew flags silently.

Disaster recovery exercises should include a tabletop where the domain expires but backups remain intact. Teams rehearse registrar login, payment, and DNS restoration sequences without touching production TLS, reinforcing that registration recovery is a distinct skill from certbot renewal.

Privacy regulations may limit which colleagues can view RDAP registrant fields; publish internal guidance on who may request exports and how long to retain them. Security teams need expiration dates without hoarding personal data unrelated to renewal workflows.

Align check domain expiry date reviews with certificate steering committee meetings if your organization has one. Combined agendas prevent the same executives from hearing about TLS and registration risks in separate siloed briefings that obscure root cause relationships.

Partner with accounts payable to match credit card expiry on file at registrars with domain auto-renew settings. Payment failures mimic registration crises even when RDAP still shows future expiration until grace periods end.

Insurance renewals for cyber policies increasingly ask whether domain registration tracking exists separately from certificate monitoring. RDAP screenshots attached to insurance binders satisfy underwriters faster than narrative claims without artifacts.

Philanthropy and foundation microsites on dedicated domains sometimes inherit registration records from volunteers who left years ago. Annual check domain expiry date campaigns should include nonprofit properties explicitly because their outages attract media attention disproportionate to traffic.

Joint ventures dissolving need registration sunset plans alongside certificate teardown. Partners forget names registered in holding companies until RDAP shows expiration aligned with legal separation dates in M&A agreements.

Remote-first companies registering domains through personal accounts during early startup years must migrate ownership before IPO readiness reviews. Auditors flag personal registrant emails on production domains as material control weaknesses.

Quarterly tabletop exercises should include a scenario where RDAP and TLS dashboards disagree; participants practice reconciling dates before announcing customer impact and before executives post public statements on social media without operations sign-off.