Domain redemption period after expiry

domain redemption period is the expensive recovery window after standard renewal grace: registries allow restore only with extra fees while the name still cannot transfer—waiting here turns a missed invoice into a five-figure brand crisis.

DNS administrators and finance controllers encounter redemption when auto-renew failed and nobody acknowledged registrar emails. TLS may still look healthy while RDAP status shifts from clientDeleteProhibited patterns toward redemptionPeriod or pendingDelete semantics per registry.

Teams confuse redemption with ordinary late renewal. Redemption often freezes DNS updates, blocks transfers, and breaks ACME validation even if an old cert still decrypts. You will read RDAP flags, pay restore through the sponsoring registrar, and reconcile TLS before public deletion.

Procurement should tag redemption invoices separately from normal renewals in cost centers so leadership sees domain redemption period as preventable operational debt, not surprise capital expense.

Redemption runbooks should name finance approvers with authority above quoted restore fees so overnight registry deadlines are not missed waiting for Monday morning signatures. Keep registrar case numbers beside openssl transcripts in the same incident channel.

What to check

Identify redemption via RDAP status arrays and registrar portal banners—not guessing from WHOIS marketing copy. Compare expiration event dates with today's UTC calendar.

Verify whether DNS still answers authoritatively or parking replaced glue. Check if email and ACME challenges fail despite openssl showing future notAfter.

Confirm transfer locks: during domain redemption period, outbound transfers are typically blocked until restore completes.

Cross-check TLS SANs cover production hostnames after restore—issuance may fail until NS propagation stabilizes, using RDAP lookup domain expiration alongside handshake probes.

Trademark counsel should join domain redemption period calls when contested brands approach pending delete. Waiting for engineering to finish TLS tickets while legal negotiates restore fees burns registry timers that cannot pause for business hours in your time zone.

Global teams must convert RDAP eventDate to UTC in runbooks. A redemption deadline that falls during APAC night shift still expires on registry schedules written in UTC; on-call handoffs need explicit ownership at sponsorship registrars with payment authority.

Step-by-step

RDAP status sweep

curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/example.com" \
  | jq '{ldhName: .ldhName, status: .status, events: .events}'

Registrar restore workflow

# Document fee quote and case ID in your ticket before paying—no universal CLI
whois example.com | grep -iE 'status|expir|redemption'

Prefer sponsor registrar support chat with RDAP JSON attached.

Validate DNS after restore payment

dig +trace example.com NS
dig @8.8.8.8 A www.example.com

Re-run TLS issuance dry run

certbot renew --dry-run 2>&1 | tail -20

Only after NS looks correct; dns-01 fails while redemption parking still serves.

Finance reconciliation

Export registrar PDF receipt and match RDAP last changed event timestamp for audit.

See also check domain registration expiry when building monthly registrar reports.

How to read the output

Redemption status means the registry removed the name from active DNS pool logic but has not released it publicly. Restore fees stack on top of standard renewal; some ccTLDs use different vocabulary with the same effect.

If RDAP shows pendingDelete, redemption time may already be exhausted—escalate immediately with legal if the brand is trademarked.

Post-restore, propagation can take hours; crawlers may still see parking HTML while engineers see green internal checks splitting egress.

Document hourly RDAP polls during restore weekends so executives see objective progress beyond registrar chat optimism.

After restore, rebuild internal documentation listing every ACME client, CDN upload, and HSTS preload submission tied to the brand. Redemption downtime may have expired validation tokens or auth codes stored only in chat logs engineers already deleted.

Finance should accrue redemption fees as contingent liabilities when RDAP expiration crosses below thirty days without matching payment receipt. Auditors increasingly ask whether domain assets receive the same controls as code signing keys; domain redemption period invoices belong in that evidence pack.

SEO agencies need written notice when status arrays include redemptionPeriod so they pause link-building to deep URLs that may 404 without warning when parking rotates.

Common mistakes

Paying standard renewal fees in the portal without choosing explicit restore—name stays deleted.

Issuing new TLS before DNS delegation returns—wastes CA rate limits during firefights.

Attempting transfer during redemption to escape fees—policy blocks the move and wastes calendar days.

Assuming redemption lasts ninety days for every TLD—ccTLD timers differ; read sponsor documentation.

Skipping domain and SSL expiry monitoring after a scare and repeating the lapse next year.

Treating registrar support estimated restore time as guaranteed when board meetings depend on the URL being live.

When to use automation

Redemption is the failure mode registration monitors exist to prevent. Schedule RDAP checks with alerts well before expiration, plus status diffs when redemptionPeriod appears.

ssldays tracks registrar expiry fields where registries publish them and live TLS on enrolled hostnames, emailing 30, 14, 7, and 1 day notices. Add production brands at /register; Starter and Pro add hourly polling and chat webhooks for finance and platform owners sharing redemption risk.

Treat redemption restore as a post-incident review trigger: auto-renew card, WHOIS billing contacts, and RDAP unknown TLD rows.

Inventory every hostname that referenced the name in mobile apps, email signatures, and PDF collateral before redemption ends. domain redemption period recovery costs more when marketing reprints materials pointing at URLs you almost lost.