Domain expiry checker

What this reads

It asks the domain's registry directly over RDAP — the structured, machine readable successor to WHOIS — and reports the expiry date, the registrar, the nameservers on record, the transfer lock and whether DNSSEC is enabled.

RDAP rather than WHOIS because WHOIS is free text that every registry formats differently, so anything reading it is guessing. RDAP returns JSON with defined fields, which is why the date here can be trusted rather than parsed out of a paragraph.

Why a domain lapses when somebody is definitely paying for it

Nobody forgets to renew a domain. What happens is one of these:

• The card on the registrar account expired, and the renewal notice went to an address nobody reads — often a personal address belonging to whoever registered it years ago.
• The domain is on auto-renew at a registrar that quietly failed to charge it.
• It belongs to a client, the agency assumed the client had it, and the client assumed the agency did.
• The person who registered it left the company and the account went with them.

The failure is total and immediate: the site, the mail and everything else on the domain stop at once. Recovery is possible during the redemption period and costs a redemption fee, and after that the name goes to auction.

The registrar lock

The transfer lock — clientTransferProhibited — stops the domain being transferred to another registrar without being unlocked first. It should be on for every domain you are not actively transferring.

It gets switched off during a legitimate transfer and left off afterwards, which is how a domain sits for years one successful phishing email away from being moved somewhere else.

DNSSEC

DNSSEC signs the domain's DNS answers so a resolver can verify they came from the real nameservers rather than from somebody who intercepted the query. It is not mandatory and plenty of large domains do without it.

It is worth turning on, and it is worth knowing when it turns itself off: a botched nameserver migration that drops the signing records makes the domain unresolvable for anybody using a validating resolver — a hard outage for a subset of the internet and a perfectly healthy site for you.

What this checker reads

One RDAP query to the registry. No account is needed and the domain you type is not stored.