Route 53 registered domain expiration

route53 domain expiration tracks AWS registration billing separately from hosted zones, ACM certificates, and CloudFront distributions—Route 53 can host DNS while another registrar owns the name, or the opposite.

Cloud engineers assume everything in one AWS bill auto-renews together. Registered domains in Route 53 have their own renewal line item, contact verification, and RDAP sponsorship distinct from ACM notAfter on the same brand.

Missed domain renewal in Route 53 silently jeopardizes ACM dns-01 validation and corporate email on SES. You will inventory registered domains in the account, cross-check RDAP, and align TLS renewals with registration payments.

Cost anomaly dashboards should flag route53 domain expiration rows even when EC2 and RDS spend is flat—domain renewals are tiny charges easy to miss in consolidated invoices.

Tag registered domains in AWS Resource Groups with application owners so FinOps alerts route to teams who recognize the hostname, not only central cloud billing inboxes that treat domain renewals as noise.

What to check

Route 53 Registered domains list in each payer account and linked organizations via Organizations SCP visibility.

Auto-renew and transfer lock flags per domain in console; enable billing alerts on domain renewal SKU.

ACM certificate status and whether validation CNAMEs live in the same hosted zone Route 53 serves.

Cross-account DNS: domain registered in payer A while production zone lives in payer B—inventory both.

Validate externally with check domain registration expiry because console dates should match RDAP.

Landing zones and Control Tower accounts sometimes register domains in security OU payer profiles engineers cannot see without Organizations access. route53 domain expiration surprises happen when application teams own CloudFront distributions but finance pays only the workload account bill.

Consolidated billing hides small domain renewal charges inside larger invoices. FinOps teams tracking EC2 savings plans miss five-dollar renewals that still delete production apex rows when ignored for two consecutive quarters.

Step-by-step

List registered domains (CLI)

aws route53domains list-domains --region us-east-1 \
  --output table --query 'Domains[*].[DomainName,AutoRenew,Expiry]'

Route 53 Domains API uses us-east-1 regardless of workload region.

Detail one domain

aws route53domains get-domain-detail --region us-east-1 --domain-name example.com \
  --output json | jq '{AutoRenew: .AutoRenew, Expiry: .ExpirationDate, StatusList: .StatusList}'

RDAP cross-check

curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/example.com" \
  | jq '.events[] | select(.eventAction|test("expir"))'

Method reference: RDAP lookup domain expiration.

Compare ACM expiry

aws acm list-certificates --region us-east-1 --output text
aws acm describe-certificate --region us-east-1 \
  --certificate-arn arn:aws:acm:us-east-1:ACCOUNT:certificate/ID \
  --query 'Certificate.{Domain:DomainName,NotAfter:NotAfter,Status:Status}'

Live TLS on customer hostname

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -enddate

For Organizations with delegated admin access, run list-domains from the management account role weekly and email CSV diffs to application owners. route53 domain expiration misses most often on sandbox accounts that still host marketing redirects used in production email templates.

How to read the output

Console ExpirationDate should align with RDAP expiration events within a day. AutoRenew true plus failed payment method still yields route53 domain expiration risk—watch AWS Budgets billing anomaly emails.

ACM NotAfter can be sooner than domain expiration; both matter. If domain lapses, ACM cannot revalidate even when cert status still shows ISSUED until failure.

StatusList values like pendingDelete require immediate console renewal, not only ACM reissue.

Organizations with dozens of accounts need a weekly Lambda or manual script aggregating list-domains outputs—console switching is error-prone.

Disaster recovery drills copying hosted zones to backup accounts sometimes omit registered domain sponsorship still tied to primary payer. Failover DNS ready in account B cannot publish authoritatively when route53 domain expiration lapses in account A.

Partner-led implementations may register client domains under partner payer for convenience. Contract exit requires transfer months before renewal, not days, or client loses email the partner forgot to auto-renew while ACM still shows ISSUED.

AWS Support cases for domain restore need console domain name and registry status list captured before midnight UTC deletion windows some TLDs enforce.

Tag Lambda inventory jobs with account ID and payer profile name so cross-account domain lists never omit sandbox registrations that still serve production marketing redirects.

Common mistakes

Assuming ACM auto-managed certs renew the domain registration—they do not.

Deleting hosted zones while registered domain remains—confusing inventory during offboarding.

Using personal AWS accounts for production domains without enabling billing alarms.

Transferring domain to Cloudflare or retail registrar while forgetting to disable stale Route 53 auto-renew on the old record.

Monitoring only CloudWatch Synthetics TLS without RDAP on the registrable apex.

Assuming cross-account DNS delegation removes renewal duty from the payer account that still owns registration.

When to use automation

Multi-account AWS estates need RDAP plus TLS monitoring outside any single console login. Route 53 API lists are authoritative for registration but not for edge TLS customers see on CloudFront aliases.

Include list-domains output in monthly SOC evidence packages beside ACM describe-certificate summaries so auditors see both AWS-native clocks.

ssldays probes live HTTPS and RDAP registration dates, alerting 30, 14, 7, and 1 days ahead. Enroll production hostnames at /register; pair with domain and SSL expiry monitoring for brands that split DNS and registrar between vendors.

Export list-domains monthly into ticketing; let ssldays watch the same names without IAM keys on engineering laptops.

Reserved instances and savings plans reviews are quarterly; route53 domain expiration deserves the same calendar invite. Small line items still delete DNS authority for billion-dollar brands when ignored twice consecutively.