🌐 How you lose a domain name (and how to avoid it)

🌐 Français · English · العربية

A domain name is never lost in one go: it expires, goes through several stages, and then someone else picks it up. My own story, the exact timeline, the real causes and the method to never lose a domain again.

Updated: 22 October 2026

In short

• An expired domain does not vanish right away: for a .com, it goes through a grace period, a 30-day redemption period, then 5 days of pending deletion. After that, it is released.
• Bots are waiting for these domains: "drop catching" services re-register them the very second they become available, especially if they still have traffic and links.
• The cause is almost always mundane: an expired bank card, a reminder email landing in an inbox nobody reads, a domain still held by a former provider.
• The consequences go well beyond the website: lost emails, accounts tied to that address, links and search rankings that benefit someone else, reputation.
• Prevention comes down to a few settings: auto-renewal, up-to-date payment details, a contact email on another domain, a transfer lock and automatic monitoring.

1. My story

While going through my websites, I found something I did not expect: one of my old .com domains no longer pointed to my server.

The site itself was still running. On my server, everything responded normally. But anyone typing the address into a browser landed on… a foreign online gambling site, with no connection whatsoever to my work.

The explanation fit in three lines of the domain's public record (the WHOIS):

• the domain had expired without me noticing;
• it had then been re-registered by a third party a few months earlier, through a registrar known for recovering expired domains;
• it was now managed by another owner, on another hosting setup.

So my site had been invisible for months, while my server kept serving it to… nobody. The new owner asked far too much to sell it back. I made the sensible choice: a complete archive of the site (database and files), then a clean shutdown.

While checking everything else, I found that a second domain, a .ma this time, had also expired and was pending deletion. That one had not yet been taken by someone else.

The lesson is simple: I had no way of being warned. No monitoring, and reminders most likely sent to an address I no longer read. That is exactly what this guide helps you avoid. Since then, a check runs every night on my server: it verifies that each of my domains still points to it and flags any that no longer does. On the very day it was set up, it caught both lost domains.

2. The life cycle of an expired domain

Understanding the timeline tells you how much time you have left, and how much it will cost to fix things.

For generic extensions (.com, .net, .org, .shop…)

The rules are set by ICANN, the body that coordinates generic domain names, notably in its Expired Registration Recovery Policy (ERRP).

The exact length of the grace period and the restore fees depend on your registrar: ICANN requires them to be published on its website. The official diagram of these stages is on the generic domain life cycle page.

Drop catching: why a domain is gone in seconds

When a domain becomes available again, you get no priority. Specialised companies send thousands of registration requests at the exact second of release, on behalf of clients who reserved that domain in advance (a "backorder").

They mostly target domains with a history: inbound links, some traffic, age. A business domain, even a small one, often ticks these boxes. That is what happened to mine: reused for a gambling site that benefits from the trust the old name had built.

For .ma

.ma is a national extension, managed under the authority of the ANRT (Morocco's telecom regulator), with its own naming charter. Its rules do not all follow ICANN's.

What I can say, cautiously:

• the domain is registered for a renewable period, through an accredited Moroccan registrar;
• after expiry, several registrars mention a grace period of about 30 days, but I found no current official text setting these durations;
• my own .ma domain, once expired, showed a "pendingDelete" status in the WHOIS.

Advice: for a .ma, ask your registrar in writing for the exact durations and the cost of any restoration. And do not count on a long margin.

3. The real causes

In the vast majority of cases, nobody "stole" the domain: it was lost through neglect, often without the owner knowing.

The expired bank card

Auto-renewal was on, but the saved card expired or was replaced. The payment fails, an email goes out… and nobody reads it. This is the most common cause.

The contact email nobody reads anymore

Reminders go to the address registered with the registrar. Three classic traps:

• an old address you no longer use;
• an address whose messages end up in spam;
• an address on the domain itself (contact@yourdomain.com): as soon as the domain expires, that inbox stops receiving… the renewal reminders.

The domain held by someone else

An agency, a former developer, a friend who "took care of it": the domain was registered in their account, sometimes in their name. The day the relationship ends, nobody thinks about renewing, and you do not even have access to the account.

The small forgotten domains

The main domain is watched, but not the secondary ones: an old brand, a local extension, a project domain. Those are the first to go.

Fake renewal invoices

Conversely, beware of letters or emails that mimic a renewal notice to make you pay for a useless service or transfer your domain to another provider. A genuine reminder comes from your registrar, the one where you have an account. When in doubt, log in to that account directly, without clicking the link you received.

4. The consequences: much more than an invisible website

• Your website disappears for your customers, even though it still runs on your server.
• Your emails on that domain stop, and someone else can, in theory, recreate those addresses once the domain is taken.
• Your linked accounts are exposed: if an address on that domain is used to log in somewhere (bank, social networks, hosting, tools), the domain's new owner could potentially request a password reset. Change those addresses first.
• Your search rankings benefit someone else: links other sites made to you now point to their content.
• Your reputation is at stake: people who knew your name land on dubious content.
• Your materials become wrong: business cards, flyers, vehicles, documents, QR codes, mobile apps that display or call the old address.

If this happens to you, first check that none of your apps or current websites still point to the old domain.

5. What to do if it has happened

It all depends on the domain's stage. Start with the WHOIS (on your registrar's website or an official WHOIS service): the expiry date and the status tell you where you stand.

The domain is in its grace period

The best case. Log in to your registrar, renew immediately, check that the website and emails come back. Then fix the cause (card, email address) so it does not happen again.

The domain is in redemption

It can still be recovered, but with restore fees. Contact your registrar right away: the 30-day countdown is running, followed by the 5 days when nothing is possible anymore.

The domain is pending deletion

You can no longer renew it. Get ready to re-register it as soon as it is released, knowing that drop catching services may be faster. For a domain that really matters, some registrars also offer a backorder, with no guarantee.

The domain has already been taken

• Contact the new owner: it is possible, often through the registrar or a "domain for sale" page. Be careful: never pay outside a recognised escrow service, and know that the asking price can be very high.
• The UDRP procedure: if your domain matches a trademark you hold rights to, you can file a complaint with the WIPO Arbitration and Mediation Center. You must prove three things: the domain is identical or confusingly similar to your trademark, the current holder has no rights or legitimate interests in the name, and the domain was registered and is being used in bad faith. If the complaint succeeds, the domain can be transferred to you or cancelled. It is a paid procedure, designed for trademarks, not for a mere website name. .ma has its own dispute resolution policy, also administered by WIPO (.ma rules, in French).
• Turn the page properly:
  • back up and archive the website (database and files);
  • change the email of every account that used an address on that domain;
  • update your links, profiles, apps and printed materials;
  • inform your customers and partners if needed;
  • and, if you carry on under a new domain, set up redirects from everything you still control.

6. Never lose a domain again

Here is what I recommend, to my clients and to myself.

Registrar settings

• Auto-renewal turned on for every domain.
• Up-to-date payment details, ideally with a backup payment method.
• Multi-year renewal for important domains: you push the risk back and get several years of peace of mind.
• Transfer lock turned on: it prevents an unauthorised transfer to another registrar.
• Two-factor authentication on the registrar account.

Contact and ownership

• A contact email on another domain (for example a Gmail or Outlook address you check every day), never an address on the domain itself.
• Domains in your company's name, in your own account. If an agency or developer manages your domains, ask for them to be registered in your name and for you to have owner access.
• A single trusted registrar for all your domains, rather than one domain per provider.

Inventory and monitoring

• An inventory: the list of all your domains, with registrar, expiry date, account used and purpose (website, email, protected brand).
• A calendar with a reminder one month before each expiry date, independent of the registrar's emails.
• Automatic monitoring: a regular check (for example every night) that each domain still points to your server. The day a domain expires or changes hands, you get an alert instead of finding out months later. Note: checking that your server responds is not enough, it is the domain's DNS you need to check.
• A regular health check: my free domain check tool checks the website, the certificate, security and email configuration.

Checklist

• A list of all my domains, with expiry date, registrar and account used.
• Auto-renewal turned on for each one.
• A valid bank card (and a backup payment method).
• A contact email on another domain, read every day.
• Domains registered in my name or my company's name, in my own account.
• Transfer lock and two-factor authentication turned on.
• Important domains renewed for several years.
• A reminder in my calendar one month before each expiry date.
• Automatic DNS monitoring for each domain.
• No important account tied to an address on a domain I might lose.

FAQ

How much time do I have after my domain expires?

For a .com, you first get a grace period whose length depends on the registrar, then 30 days of redemption with restore fees, then 5 days when nothing is possible anymore. For a .ma, the durations depend on the national registry and your registrar: ask for them in writing and act fast.

My website still runs on my server, so why can nobody see it?

Because the domain name no longer points to your server. Your website still exists, but the address people type leads somewhere else, or nowhere. That is exactly what happened to me.

Can someone read my old emails after taking my domain?

They cannot access your old inbox, but they can create new addresses on that domain and receive any messages sent to them from then on. Hence the urgency of changing the address on your important accounts.

Can I get back a domain bought by someone else?

Only by buying it back from the new owner, at their price, or through a UDRP procedure if the name matches your trademark and the current holder is using it in bad faith. Otherwise, moving to a new domain is often the better option.

Is auto-renewal enough?

Not on its own. It fails silently if your card expires. Combine it with up-to-date payment details, a contact email you actually read and a reminder in your own calendar.

How do I spot a fake renewal notice?

It comes from a company you have no account with, often offers an unusual price or service, or pushes you to transfer your domain. Do not click: log in directly to your usual registrar's website to check the real expiry date.

Should I keep domains I no longer use?

If a domain has had a website, customers, links or email use, keeping it for a few years costs little compared with the risk of seeing it reused against your reputation. If you decide to let it expire, first remove it from all your materials and accounts.

Sources

• ICANN, Expired Registration Recovery Policy (ERRP)
• ICANN, generic domain life cycle
• ICANN, Uniform Domain-Name Dispute-Resolution Policy (UDRP)
• WIPO, guide to the UDRP
• WIPO, .ma dispute resolution rules (in French)

Need help?

I can inventory your domains, secure their settings and set up automatic monitoring as part of maintenance and hosting, or simply advise you: get in touch.

← All guides

← All guides