Domain registration expiry monitoring (RDAP era)

Domain expiry monitoring in the RDAP era means tracking registrar entitlement from HTTPS JSON—not guessing renewal dates from stale WHOIS pages while TLS dashboards stay green.

Portfolio owners and domain administrators juggle dozens of TLDs, each with different registry policies. Finance pays multi-year invoices; engineering watches ninety-day certificates. Registration lapse breaks DNS, blocks transfers, and eventually kills ACME validation even when a certificate file still exists on disk.

The classic mistake is treating certificate renewal as domain renewal. Another is scraping port-43 WHOIS until rate limits or GDPR redaction erase the expiration field you automated against last quarter.

This hub orients you to domain expiry monitoring that respects registry contracts, pairs RDAP with live TLS where both matter, and scales from a three-domain pilot to agency portfolios.

What this guide covers

You will learn how RDAP replaces brittle WHOIS for most gTLDs, which event fields map to registrar renewal, and how status flags like client hold appear before a visible expiration date. The scope is registration monitoring—not PKIX trust, chain staples, or cipher suites.

Operators at SaaS companies, municipalities, and MSPs share the same failure mode: the marketing site handshake succeeds while the apex domain entered the redemption grace period. Procurement discovers the gap when email from the registrar stops and Search Console shows DNS failures.

Agencies maintaining client inventories should read this alongside domain and SSL expiry monitoring so each customer row tracks two clocks without merging unrelated alerts.

Key concepts

RDAP (Registration Data Access Protocol) returns domain objects over HTTPS with an events array. Look for eventAction values containing expiration. Some registries also publish registrar expiration separately from registry expiration—both can matter during transfer windows.

Authoritative vs redirect lookups matter for automation. Manual tests through rdap.org are fine; production jobs should resolve the IANA bootstrap mapping for each TLD and honor rate limits with backoff.

Status flags (clientTransferProhibited, pendingDelete, redemptionPeriod) explain risk earlier than a calendar field. Domain expiry monitoring that ignores status treats a hold the same as a healthy renewal.

TLS notAfter on any hostname under the domain does not extend registration. Live certificate checks remain essential for customer HTTPS; they do not replace RDAP for the registrable name.

How to work through your portfolio

Start from a spreadsheet keyed by registrable domain, not every subdomain. For each apex, record registrar account, auto-renew flag, last manual verification, and RDAP last-checked timestamp.

Run a structured lookup when onboarding a domain:

DOM=example.com
curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOM}" \
  | jq '{status: .status, events: [.events[]? | {action: .eventAction, date: .eventDate}]}'

Normalize eventDate to UTC in your notes. When events omit expiration, flag the row for a registrar portal check rather than copying WHOIS cache.

Compare registration horizon with TLS on the brand apex the same day:

echo | openssl s_client -connect "www.${DOM}:443" -servername "www.${DOM}" 2>/dev/null \
  | openssl x509 -noout -enddate

Divergence by months is normal; ignoring either side is not. Document TLDs where RDAP omits dates so humans revisit quarterly.

For bulk reviews, export hostname lists and registration owners from your CMDB. Merge finance renewal receipts with RDAP output during annual audits—auto-renew toggles fail silently when payment methods expire.

When clients transfer between registrars mid-year, repeat RDAP within twenty-four hours and again after the seven-day stability window registrars advertise. Transfer locks can mask pending expiration shifts until the object stabilizes under the new sponsor. MSPs should attach the registrar portal deep link to each row so technicians skip hunting through forwarded invoice threads during after-hours escalations.

Budget time each quarter to validate RDAP coverage for new TLDs marketing purchased without IT review. Shadow domains are the fastest path to renewal surprises on live campaign hostnames still billing the wrong registrar account.

Related guides in this silo

Diagnostics and protocols

• RDAP lookup for domain expiration — curl and jq patterns for events and statuses.
• Check domain registration expiry — manual verification when JSON is incomplete.
• RDAP vs WHOIS for domain expiration dates — when to stop scraping port 43.

WHOIS transition and comparisons

• WHOIS expiration date alternatives — registrar APIs when RDAP redacts.
• Live certificate check vs registrar WHOIS — why handshake green does not imply paid registration.

Commercial and combined monitoring

• RDAP domain expiry monitoring tool — evaluation criteria for scheduled RDAP checks.
• Domain and SSL expiry monitoring in one place — unified timelines for TLS and registration.

When to use automation

Manual RDAP checks work for annual audits; domain expiry monitoring at scale needs scheduled lookups, deduplicated alerts, and honest unknown handling when a TLD hides expiration.

ssldays reads live TLS certificates on enrolled hostnames and supplements RDAP registrar expiry where registries publish it. Email alerts fire at 30, 14, 7, and 1 days ahead, once per threshold per cycle. Free covers 3 domains with daily checks; Starter supports 25 at hourly cadence with Slack and Discord webhooks; Pro handles 100 hostnames with the same alert ladder.

Prove any suspicious hostname immediately at /check, then enroll brands that must not lapse before the next finance review. Pair automated RDAP with the registrar vs certificate expiry hub so on-call understands which clock triggered each page.