Domain monitoring: expiry, DNS and ownership changes, explained.
Domain monitoring re-checks a domain on a schedule and records what changed: expiry, registrar, status codes, nameservers, DNS records and the HTTPS certificate. This guide explains what each of those means, when an expired domain really becomes available, and which changes deserve your attention.
Updated September 202612 minute readSources: ICANN, IETF
- from expiry until a .com is released
- Up to 80 daysfrom expiry until a .com is released
- between checks on the last day before a drop
- 15 minutesbetween checks on the last day before a drop
- networks recognised to filter DNS noise
- 28networks recognised to filter DNS noise
- urgent alerts, one email per incident
- At onceurgent alerts, one email per incident
What does a domain monitor watch?
Everything public that decides whether a domain works and who controls it: the expiry date, registrar and registry status codes from RDAP, the DNS records, and the HTTPS certificate. Each is re-checked daily, and more often as a domain approaches its drop.
| Monitored | Re-checked | What you get |
|---|---|---|
| DNS records | Every 24 hours | Nameservers, mail, addresses and text records, with a before and after for every meaningful change. |
| Email protection | Every 24 hours | SPF and the DMARC policy: whether mail forged in the domain’s name is rejected, and how to fix it if not. |
| Registry status | Every 24 hours | Status, registrar with its IANA id, abuse contact and every registry status code. |
| Expiry date | Every 24 hours | Wherever the registry publishes one, which most but not all extensions do. |
| HTTPS certificate | Every 24 hours | Issuer, expiry and whether the certificate matches the name. |
| Resale listing | Every 24 hours | An asking price, where a marketplace publishes one. |
| Expiring within 30 days | Every 5 hours | A renewal or a lapse can happen on any day now. |
| Redemption or expired | Every 5 hours | The owner either restores the name or lets it go. |
| Pending delete | Every hour | The last five days before the name is released. |
| Last day of pending delete | Every 15 minutes | Until it is released, and you are emailed within minutes. |
A lookup answers once. That is the wrong tool for a domain you want but cannot have yet, or one you own and cannot afford to lose. Domain Hub keeps looking at the domains you chose, filters out the noise public records produce all day, and keeps what actually moved.
When does an expired domain become available?
Not on the expiry date. A typical .com passes through up to 45 days of auto-renew grace, 30 days of redemption and 5 days of pending delete before anyone can register it, so it is released somewhere between about 35 and 80 days after it expires.
A typical .com, from expiry to release
- Day 0
Step 1: The expiry date passes
Registrars must send renewal reminders about a month and a week before this day, and at least one more within five days after it.
- Days 0 to 45
Step 2: Auto-renew grace
The owner can still renew at the normal price. The registrar must keep the name renewable for at least eight days and must stop it resolving before it is deleted. How long this phase lasts is the registrar’s choice and is never published.
- 30 days
Step 3: Redemption
The registrar has deleted the name. For 30 days only the previous owner can restore it, usually for a restore fee well above a renewal. It no longer resolves and cannot be transferred.
- 5 days
Step 4: Pending delete
Nothing can stop it now. The name is queued for release, so the drop date is known to the day.
- Released
Step 5: Anyone can register it
The name returns to the pool. A sought-after name is usually caught within seconds by drop-catching services.
Why a drop date is an estimate until redemption
The grace period belongs to the registrar and is never published, so before redemption starts nobody can name the release date, whatever they claim. Once the registry moves a name into redemptionPeriod, the remaining 35 days are fixed and the countdown becomes reliable. It is most precise when Domain Hub saw the phase begin itself, which is the practical argument for adding a domain you want long before anything happens to it. For every step in detail, read what happens when a domain expires.
What do domain status codes like clientTransferProhibited mean?
They are EPP status codes the registry publishes for every domain, saying what may be done with it: whether it can be transferred, changed, renewed or deleted, and whether it is already on its way out. Codes starting with client are set by the registrar, codes starting with server by the registry.
| Status code | What it means | What it means for you |
|---|---|---|
| clientTransferProhibited | Transfers to another registrar are refused. | Normal protection, often on by default. The owner can lift it in their account. |
| clientUpdateProhibited | Changes to contacts and nameservers are refused. | Protection against a quiet takeover. Lift it before changing DNS. |
| clientDeleteProhibited | Deletion is refused. | Protection. A name with it cannot be deleted by mistake. |
| clientRenewProhibited | Renewals are refused. | Unusual. Ask the registrar why, especially on a name you own. |
| clientHold | The registrar has taken the name out of DNS, so it does not resolve. | Often non-payment or a dispute. The site and email are down until it is lifted. |
| Status code | What it means | What it means for you |
|---|---|---|
| serverTransferProhibited | The registry refuses transfers. | Either a Registry Lock the owner asked for, common on big brands, or a dispute. |
| serverUpdateProhibited | The registry refuses changes. | Usually part of the same Registry Lock. Changes go through the registrar and registry together. |
| serverDeleteProhibited | The registry refuses deletion. | Usually part of the same Registry Lock. |
| serverRenewProhibited | The registry refuses renewals. | Rare, and a sign of a legal dispute or a pending deletion. |
| serverHold | The registry has taken the name out of DNS. | Serious. Only the registrar can resolve it with the registry. |
| Status code | What it means | What it means for you |
|---|---|---|
| autoRenewPeriod | The registry renewed it automatically after expiry. | The registrar can still delete it during the grace period. The drop clock may be running. |
| redemptionPeriod | Deleted by the registrar and held for 30 days. | Only the previous owner can restore it. If nobody does, it drops about 35 days from now. |
| pendingRestore | A restore from redemption has been requested. | The owner is taking it back. It returns to redemption if the restore is not completed. |
| pendingDelete | Queued for release in five days. | Nothing can stop it. Be ready on the drop date. |
| Status code | What it means | What it means for you |
|---|---|---|
| ok | No locks and nothing pending. | Healthy, but unprotected. Owners usually add transfer and delete locks. |
| addPeriod | The first days after registration. | A fresh registration. Informational only. |
| renewPeriod | The days after a renewal. | Just renewed, so it is not going anywhere soon. |
| transferPeriod | The days after a transfer between registrars. | Just moved. Unexpected on a name you own? Check it now. |
| pendingTransfer | A transfer between registrars is in progress. | Unexpected on a name you own? Contact your registrar immediately. |
| pendingUpdate | A change is being processed. | Unexpected on a name you own? Contact your registrar immediately. |
| inactive | No nameservers are set. | Registered but not in use, so it does not resolve. |
Who holds a domain, and where to complain
Next to the codes, each domain shows its registrar with the IANA identifier and the published abuse contact. If a name is being misused, that is where the complaint has to go. Stuck on a transfer? See why a domain transfer is blocked.
How does DNS change monitoring avoid false alarms?
By comparing each answer with the operator behind it and with the sets the domain used in the last fourteen days. Rotation inside one content delivery network, rising SOA serials and TTLs ticking over stay quiet. A move to a different operator, new nameservers or new mail routing is recorded with the before and after.
Kept quiet
Routine churn, filtered before it becomes a change.
Edge servers rotating
18.239.69.110, 18.239.69.12
18.66.147.121, 18.66.147.25
Both sets are Amazon CloudFront. One operator, no news.
An SOA serial counting up
ns1.example-dns.net. 1561008850
ns1.example-dns.net. 1561008852
It rises with every edit the DNS host makes, including its own housekeeping.
A set the domain already used
203.0.113.9
198.51.100.7
Seen in the last fourteen days, so it reads as rotation.
Recorded
Someone made a decision. That is what a change record is for.
A different DNS operator
ns1.digitalocean.com
aria.ns.cloudflare.com
Nameservers are who controls the name. Always reported.
The website moved
18.239.69.110
34.149.36.179
Recorded as moved from Amazon CloudFront to Google Cloud.
Mail routing changed
aspmx.l.google.com
example-com.mail.protection.outlook.com
Where a company reads its mail is a fact about the company.
The same filter runs on the lookup made when you open a domain, so browsing your own Hub can never manufacture history. Every recorded change keeps the previous value, so it still reads as a decision months later. New to the record types? Start with DNS records explained.
Which domain changes point to a hijack or an outage?
A registrar you did not choose, nameservers you did not set, and a domain that stopped resolving. Those are the shape of an account takeover or an outage, so Domain Hub raises them separately from ordinary record history.
Registrar changed
The name moved to another registrar. Expected if you moved it, and one of the clearest signs of a hijack if you did not.
Nameservers changed
Control over where the domain points changed. The step that turns a compromised account into a redirected website.
DNS stopped resolving
The domain answers nothing. For a name you own it is an outage, for one you watch it is often the first sign of abandonment.
Authoritative nameservers disagree
The servers responsible for the name answer differently, usually a change half-way through or a misconfiguration.
HTTPS certificate expiring
Warned only once renewal looks overdue for that certificate: with a sixth of its lifetime left, at most 30 days, and again at a twelfth, at most 7. Short-lived certificates renewing on schedule never trigger it.
HTTPS certificate changed
A new certificate, a different issuer, or one for another name. Routine on renewal, worth a look when unexpected.
If one of these appears on a domain you own, read how domain hijacking happens and how to stop it and what to do if a domain was transferred without permission.
Can I monitor a domain someone else owns?
Yes. Expiry dates, status codes and DNS are public, so a domain you want shows exactly the same detail as one you own. Most good names are registered and many are unused, and watching one puts you ahead of everyone who only checks it once.
Mail records disappear
The business behind it may have wound down.
Nameservers revert to a registrar default
Often a site that has been taken down.
The expiry date passes without renewal
The grace period has started.
redemptionPeriod appears
Deleted. Unless restored, it drops about 35 days later.
The name is listed for sale
The owner has named a price, so it is buyable today.
Registered in the last month
Marked new, so a name that dropped and was caught is obvious.
For how often names actually come free, see how many domains drop every day.
How do domain expiry alerts work?
In two lanes, so urgency stays urgent. Anything that cannot wait, such as a domain in its last days, a registrar change or a name that just became available, is sent at once, one email per incident, while warnings that can wait a day are sent at most daily. Everything else waits for a daily, weekly or monthly summary at your chosen local hour.
2 domains need your attention
clientsite.com
thenameyouwant.io
Your weekly Domain Hub digest
Where does the data come from?
From the public record only: RDAP, the registries’ structured successor to WHOIS defined in RFC 9083, and live DNS. No registrar logins, no API keys, no access to anything you own.
- Every timestamp says which clock it came from.
- A change is found on the next check, so the Hub keeps when it observed a change next to the registry’s own last-changed date. A name that moved an hour ago never looks like one that moved long before you started watching.
- A price is only shown where a price exists.
- An available name shows the cheapest published first year across registrars, a listed name its asking price. A registered name with no listing shows none, because its cost is whatever its owner would accept.
- Nobody can tell you whether a domain will renew.
- Auto-renew is private between an owner and their registrar and appears in no public record. Anything that promises to predict a lapse is guessing.
Domain monitoring questions
Short answers to what people ask most about watching domains.
What is domain monitoring?
Domain monitoring means re-checking a domain on a schedule and recording what changed: its expiry date, registrar, registry status codes, nameservers and DNS records, and its HTTPS certificate. A one-off lookup tells you what is true this second. Monitoring tells you when that changed, from what, and to what.
How long after expiry does a domain become available?
For a typical generic domain such as .com, usually somewhere between about 35 and 80 days after the expiry date. The registrar may keep it for up to 45 days of auto-renew grace, the registry then holds it for 30 days of redemption and 5 days of pending delete, and only then is it released. The grace period is the part that varies, so any drop date before redemption starts is an estimate.
What does clientTransferProhibited mean?
It means the registrar has locked the domain against transfer to another registrar. It is on by default at many registrars as protection against hijacking, and the owner can switch it off in their registrar account. On a domain you are buying it is a step in the process, not a refusal.
Can I get an alert when a domain becomes available?
Yes. Add the domain to Domain Hub and it is checked at least once a day, every five hours once it is expiring or in redemption, hourly in pending delete and every 15 minutes on its last day. When it becomes available to register, the email goes out within minutes.
Why do I not get an alert every time a DNS record changes?
Because most DNS differences are not events. Content delivery networks rotate their edge addresses all day and SOA serials count every edit a DNS host makes. Domain Hub recognises 28 operators by their published address ranges and compares each answer with the sets the domain used in the last fourteen days, so rotation stays quiet and a real move is recorded and named.
Can I watch a domain someone else owns?
Yes, and it is one of the main reasons to use a monitor. Everything Domain Hub reads is public registry and DNS data, so a domain you want shows the same expiry date, status codes and change history as one you own.
Can anyone tell whether a domain will be renewed?
Not in advance. Auto-renew is private between the owner and their registrar and appears in no public record. Afterwards it shows: a .com that was not renewed by its expiry date gets the status auto renew period for up to 45 days while the registrar charges for it or deletes it, even though the registry has already moved the expiry date a year ahead. Domain Hub reads that status and says so, and a hold on top of it means the renewal was not paid.
How many domains can I monitor?
Free accounts monitor 5 domains, Pro up to 100 and Scale up to 1,000. Free includes email alerts for one domain; paid plans cover every selected domain.
Further reading
- What happens when a domain expires?
- How many domains drop every day?
- Domain hijacking: how it happens and how to stop it
- Was my domain transferred without my permission?
- Why is my domain transfer blocked? Every lock, decoded
- DNS records explained: A, AAAA, CNAME, MX and TXT
- The domain portfolio audit checklist
Sources
- ICANN: EPP status codes, what do they mean
- ICANN: Expired Registration Recovery Policy
- IETF RFC 9083: RDAP JSON responses
Comparing names rather than tracking them? A shortlist holds candidates, a project keeps the survivors with notes, and the bulk checker answers a whole list at once.