Domain & DNS expiry monitoring

What it does

A lapsed domain takes a client’s website and their email down, and unlike a lapsed certificate it can be lost for good: once the grace and redemption periods are over, anyone can register the name. So for every site you connect, on every plan, WPClientHub looks after its registrable domain — the part somebody actually pays a registrar for. For shop.example.co.uk that is example.co.uk, worked out from the Public Suffix List, not by chopping off the last two labels.

Once a day we check two things:

• The registration, straight from the registry’s RDAP service (the modern, structured replacement for WHOIS — we never scrape WHOIS): the expiry date, the registrar, the registry’s status flags (transfer lock, hold, pending delete, redemption…) and the nameservers on record. Which registry to ask comes from IANA’s official RDAP list.
• The DNS: the domain’s nameservers, the apex A/AAAA addresses, www (its CNAME or address), the mail servers (MX), and the site’s own hostname when it is neither the apex nor www.

Where you see it

• The Domain card on each site’s Overview tab: registrar, expiry date with the days left, registration date, status flags, nameservers, the DNS records we watch, the last few changes, when it was last checked, and a Check again button.
• Sites → Domains: every site’s domain on one page — anything on hold or in redemption first, then soonest expiry — with counts for “expired, on hold or 7 days or less”, “expiring in 30 days”, “expiry not published” and DNS changes in the last week. Read-only; anyone on the team can open it.
• The Security report: a Domain registration row under Access & transport, next to “Served over HTTPS”, with the fix in plain words (“Renew at your registrar or turn on auto-renew there”).
• The health score: −10 when the domain has expired or is on hold, pending delete or in redemption; −5 in the last 7 days before it expires. Nothing for a domain whose registry does not publish a date. See The health score, explained.
• Client reports: one line in the Uptime section — “Domain example.com is registered until 14 March 2027 (registrar: …).”
• The Activity Log (Security category): nameserver and address changes, mail-server changes, a confirmed renewal (“renewed — registered until …”), and a hold-type status when it appears. Renewals also appear in client reports; the DNS lines do not.

Alerts

Everything below goes through the normal alert routing — your own notification preferences (the Domains switch, on by default for Owners, Admins and Techs, never for Viewers) and any notification routes (extra email addresses, Slack, webhooks) you point at “Domains”.

• Expiry warnings at 30, 14, 7, 3 and 1 days before the registration ends, and once more on the day it expires. Each step is sent once: the steps are tied to the registry’s expiry date, so renewing moves the date and the ladder starts again from the top for the new one. The countdown emails go out with the morning sweep (07:05 UTC); an already-expired domain is emailed as soon as a check sees it.
• Hold, pending delete or redemption: one email as soon as a check sees it, then nothing more until that status clears (if it comes back later, that is a new email). While one of these is active the countdown emails stay quiet — the status email already says when the registration ends.
• Nameserver changes — the classic sign of a hijacked registrar account or a domain that lapsed and was parked — and the site’s address being replaced (the apex or the site’s own hostname now points somewhere else entirely). Before anything is recorded or emailed we look a second time, ten minutes later; a change that is gone by then is dropped. One email per confirmed change: “Nameservers for brightleaf.co changed from … to …”.
• Not emailed, only logged: mail-server (MX) changes, www changes when the site does not live on www, and an extra address added next to the existing one.

How to

1. Nothing to set up. A site’s domain is first checked when you add the site (and again when WPClientHub One connects), then every night.
2. To refresh it now — say, right after renewing — open the site, go to Overview → Domain and press Check again. It asks the registry afresh rather than using the shared daily answer. Owners, Admins and Techs can do this, at most once every 5 minutes per site.
3. To see the whole portfolio, open Sites and switch to the Domains tab. Use Needs attention to see only domains that are expired, on hold, or expiring within 30 days.
4. To change who hears about it, go to Settings → Notifications and use the Domains switch, or add a route for it.

“Expiry date not published by this registry”

Some registries — mostly country-code ones — do not run a public RDAP service, so there is no expiry date we could honestly show. At the time of writing IANA’s list has no RDAP service for .co, .io, .de or .eu, among others. For those domains the card and the Domains list say so, the Security row is marked “not checked” and costs nothing, and we still watch the nameservers and DNS every day — so a domain that stops resolving still gets noticed. We never guess a date or scrape WHOIS to get one. The list is refreshed weekly, so when a registry starts publishing, its domains pick it up on their own.

What it does not do

• It does not renew anything or log in to your registrar. Renewal happens where the domain is registered.
• It cannot tell you whether auto-renew is switched on: that is a setting at the registrar, and registries do not publish it. The card says where to check. If auto-renew is on and it still fails, the usual reason is an expired card on the registrar account.
• It does not change DNS records, and it does not watch every record in the zone — only the ones listed above.
• It does not monitor an address that has no domain of its own: a site reached by IP address, or a hosting platform’s own subdomain (for example client.pantheonsite.io), which the hosting company renews.

Limits & defaults

Troubleshooting