badssl.com: Registered, 154 days to expiry

Domain expiry explained: WHOIS vs RDAP, locks, and what happens after a domain expires

Checked against ICANN, registry and registrar documentation on 18 October 2026; sources at the end.

WHOIS vs RDAP

WHOIS is the old way to look up who registered a domain and when it expires: a plain-text answer on port 43, in a format that differs from one registry to the next, so tools have to guess where the expiry date is. RDAP (Registration Data Access Protocol, RFC 9082 and RFC 9083) answers the same question in JSON over HTTPS, with standard fields: events for registration, expiration and last change, status for the EPP status codes, and entities for the registrar. IANA publishes a bootstrap file that says which RDAP server answers for each TLD; for .in it is rdap.nixiregistry.in, run for the NIXI registry.

Since 28 January 2025 ICANN no longer requires gTLD registries and registrars (.com, .net, .org and the new gTLDs) to run WHOIS; RDAP is the required service. Country-code TLDs set their own rules, and personal contact details are usually redacted in both. This tool reads RDAP through the IANA bootstrap and falls back to rdap.org, so the expiry date comes from the registry, not from a reseller's web page.

Registrar lock and the status codes you will see

Status	What it means
clientTransferProhibited	Registrar lock. The registry rejects transfers to another registrar until you remove it. Keep it on.
clientUpdateProhibited / clientDeleteProhibited	The registrar blocks changes to contacts or name servers, or deletion, without an extra step in your account.
serverTransferProhibited, serverUpdateProhibited	The same locks set by the registry. Registry lock services use them for high-value domains: changes need out-of-band verification.
clientHold / serverHold	The domain is not published in DNS, so the website and email stop. Often unpaid renewals, a verification request or a dispute. For .in, a serverHold is lifted by NIXI, which may ask for ID and address proof.
autoRenewPeriod, redemptionPeriod, pendingDelete	The domain has expired and is somewhere in the grace, redemption or deletion stage in the table above.

RDAP spells them in words (client transfer prohibited); WHOIS and EPP write them in camel case. A domain with only ok or active has no lock at all.

Auto-renew is not a guarantee

Auto-renew charges the card on your registrar account a few days or weeks before expiry. It fails quietly when the card has expired, the bank declines an international charge, or the account was closed when someone left the company. The registrar's warnings go to the account email; if that address is on the domain that is expiring, the warnings stop arriving the day it expires. Renew for several years at a time, keep the account email on a different domain, and watch the expiry date from outside.

What happens after expiry: grace, redemption, deletion

Stage	Typical gTLD (.com, .net, .org)	.in (as published by Amazon Route 53)
Before expiry	Renew at the normal price. ICANN's expired-registration policy makes registrars send reminders about 1 month and about 1 week before expiry.	Renew at the normal price until the expiration date.
Expiry day (day 0)	The registry usually auto-renews and charges the registrar; the registrar decides whether to keep the name for you, and must send one more notice within 5 days.	The registration expires; what the registrar does next is its own policy.
Grace after expiry	Auto-renew grace period of up to 45 days at the registry (45 for .com). The registrar must interrupt DNS for at least the last 8 days you can still renew, so the site and email stop working.	Late renewal is possible until 29 days after expiration (Route 53).
Redemption	Redemption grace period: 30 days after the registrar deletes the name. DNS is off, transfers are blocked, restoring costs a redemption fee on top of the renewal.	Restoration with the registry is possible between 30 and 60 days after expiration.
Pending delete	5 days. Nothing can be done; the name is then released and anyone can register it.	The domain is deleted from the registry 65 days after expiration.

The registry sets the outer limits; each registrar decides how much of the grace period it passes on and what it charges, especially for redemption. Once a name reaches pending delete, it cannot be saved, and drop-catching services register valuable names within seconds of release.

.in specifics

The .in registry is run by NIXI (National Internet Exchange of India); you register through a NIXI-accredited registrar, for one to ten years at a time.
RDAP for .in is served at rdap.nixiregistry.in, so this check shows the registry's own expiry date and status codes.
If a .in domain shows serverHold, the registry has taken it out of DNS; NIXI lifts it and may ask for photo ID and address proof first. Your registrar cannot remove it alone.
On the Route 53 timeline above, a lapsed .in domain can be renewed normally for 29 days and restored through the registry until day 60; after day 65 it is gone.

A short checklist so a domain never lapses

Turn on the transfer lock (clientTransferProhibited) and two-factor login at the registrar.
Renew for several years; keep a valid card and a second billing contact.
Put the registrar account email on a different domain from the one it pays for.
Monitor the expiry date and the DNS records from outside, with alerts that reach a person, not a shared inbox. A changed NS or MX record is often the first sign of a hijack.

Want a reminder without signing up? Put the expiry dates in your own calendar: the free feed below lists each domain's registry expiry date and its SSL certificate's expiry date, with reminders 14 and 3 days before, and your calendar app refreshes it about every 12 hours.

Vigil's domain monitor reads RDAP twice a day, alerts once when the expiry date comes within your threshold (30 days by default), and alerts when the A, AAAA, MX, NS, TXT or CNAME records change. Related: how to monitor domains and DNS, the DNS and email-auth check, and the SSL certificate check, because a certificate can expire while the domain is fine.

FAQ

What is the difference between WHOIS and RDAP?

Both return a domain's registration data. WHOIS is a plain-text protocol on port 43 whose format differs between registries. RDAP returns structured JSON over HTTPS, with standard fields for the expiry date, status codes and registrar, and IANA publishes which RDAP server answers for each TLD. Since 28 January 2025 ICANN no longer requires gTLD registries and registrars to run WHOIS; RDAP is the required service.

What happens when a domain expires?

For a typical gTLD the registrar stops DNS for the domain, so the website and email stop working, and you can usually still renew at the normal price for a while. After that the name goes into a 30-day redemption period, where restoring it costs an extra fee, then 5 days of pending delete, after which anyone can register it.

How long do I have to renew an expired .in domain?

Amazon Route 53, a NIXI-accredited registrar, publishes these .in deadlines: late renewal until 29 days after expiration, restoration through the registry between 30 and 60 days after expiration, and deletion from the registry 65 days after expiration. Other registrars set their own late-renewal window inside the registry's limits, so check yours.

Should my domain have a transfer lock?

Yes. clientTransferProhibited makes the registry reject transfer requests, so the domain cannot be moved to another registrar by someone who obtained the transfer code. You can remove the lock yourself when you really want to transfer.

Is auto-renew enough to never lose a domain?

No. Auto-renew fails when the card on file has expired or the registrar account is locked, and the warning emails go to the account's address. If that address is on the same domain, the reminders stop arriving once it expires. Monitor the expiry date from outside as well.

◎ Domain expiry checker

Registration

Name servers

DNS records for expired.badssl.com

Add these expiry dates to your calendar