Domain Expiration Auditor

Resilience Auditor — looks up when the site’s domain registration expires and flags renewals that are due.

Resilience

A lapsed domain takes the whole site, its email, and its certificates offline at once.

Coverage

RDAP where IANA lists a service, WHOIS everywhere else (.jp, .de, .cn, .io, .st, …).

This auditor extracts the hostname from the audited URL, asks the domain registry for the registration’s expiration date, and grades how many days remain. It never touches the web server: the answer comes from the registry, so the check works even when the site is down.

How it works

Parse — takes the hostname of the audited URL and drops a leading www..
RDAP — resolves the registry’s RDAP server from IANA’s bootstrap file and queries it. The expiration event supplies the date.
WHOIS fallback — when the TLD has no RDAP service, when the RDAP answer carries no expiration event, or when the RDAP request fails, the auditor asks IANA for the registry’s WHOIS server and parses the port-43 answer. It understands the common registry formats (Verisign, JPRS, CNNIC, nic.st, TCI, Nominet, Registro.br).
Subdomains — when a registry answers “not found” for help.example.co.jp, the auditor drops the leading label and retries with example.co.jp, down to the last two labels.
Preference — when the registry publishes no date, or no registry answers, the expirationDate preference (if set) is graded instead. When the registry does publish a date, that date is graded and a preference that differs from it adds a WARNING.
Rules — expired and expiring-within-30-days are separate FAILs; expiring-within-90-days and expiration-not-published are WARNINGs; no answer from any registry is an ERROR.
Aggregate — ERROR wins, then FAIL, then WARNING; when every rule passes the audit is SUCCESS.

Each check carries domain, queried_domain, source (rdap, whois, or preference), server, and, when known, expiration_date and days_until_expiration. A date taken from the preference after every lookup failed also carries lookup_errors; the conflict warning also carries preferred_expiration_date.

Preferences

Key	Type	Default	Description
`expirationDate`	date (`yyyy-MM-dd`)	none	The expiration date the owner tracks by hand, set per monitored URL on the Configuration tab. Used when the registry publishes no date (for example DENIC for `.de` or SWITCH for `.ch`) or cannot be reached. The registry date always takes precedence.

A value that is not a yyyy-MM-dd date is ignored and logged. A date from the preference is graded with the same thresholds as a registry date, so a forgotten preference turns into a FAIL once that date passes: update it after each renewal.

What it audits

Every row maps to one checkRule* method and one CheckCode. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.

CheckCode	Status	When it fires	Recommendation	Why it matters
`37A-DomainExpirationAuditor-500`	`ERROR`	No registry answered for any candidate name, both the RDAP and WHOIS lookups failed, or the URL has no hostname, and the `expirationDate` preference is not set.	Confirm `{host}` is a registered domain and that the registry for `.{tld}` is reachable.	—
`37A-DomainExpirationAuditor-400`	`FAIL`	The expiration date is today or in the past.	Renew `{domain}` with your registrar immediately; it expired on `{expiration_date}`.	An expired domain takes the website, every subdomain, email delivery and certificate renewals offline at once, and after the grace period the name can be deleted or bought by someone else.
`37A-DomainExpirationAuditor-401`	`FAIL`	The domain expires in 1 to 30 days.	Renew `{domain}` before `{expiration_date}`; only `{days_until_expiration}` day(s) remain.	Once the registration lapses, the website, email and certificates go offline together, and with so little time left a failed payment or a locked registrar account turns into a real outage.
`37A-DomainExpirationAuditor-300`	`WARNING`	The domain expires in 31 to 90 days.	Schedule the renewal of `{domain}` before `{expiration_date}`.	Once the registration lapses, the website, email and certificates go offline together; a renewal that fails at the last minute because of an expired card or a locked registrar account leaves no time to recover.
`37A-DomainExpirationAuditor-301`	`WARNING`	The registry answered but publishes no expiration date (for example DENIC for `.de` or SWITCH for `.ch`), and the `expirationDate` preference is not set.	Verify the renewal date of `{domain}` with your registrar and set it in the Expiration date preference.	Without an expiration date nobody is warned before the registration lapses, and a lapsed domain takes the website, email and certificates offline at once.
`37A-DomainExpirationAuditor-302`	`WARNING`	The registry publishes an expiration date that differs from the `expirationDate` preference; the registry date is the one graded.	Update the Expiration date preference to `{expiration_date}`, or clear it since the registry publishes the date.	A tracked date that disagrees with the registry usually means the renewal was recorded wrong, so the owner may plan around a date that is not the one the domain actually expires on.
`37A-DomainExpirationAuditor-200`	`SUCCESS`	All rules passed; message is `Domain {domain} is valid until {expiration_date} ({days_until_expiration} days), looked up via {source}` (or `as set in the Expiration date preference`).	—	—

Output documentation

Status	Description	Test logic
SUCCESS	The registration is valid for more than 90 days	`days_until_expiration > 90` (`200`).
WARNING	The renewal is due soon, the registry hides the date, or the preference disagrees with the registry	31–90 days left (`300`); registry publishes no expiration date and no preference is set (`301`); registry date differs from the `expirationDate` preference (`302`).
FAIL	The registration has lapsed or is about to	`days_until_expiration <= 0` (`400`); 1–30 days left (`401`).
ERROR	The auditor could not consult a registry and no preference is set	Every candidate name was “not found”, or both RDAP and WHOIS failed (`500`).

Risks and considerations

A lapsed domain is a full outage

When the registration expires the registry removes the delegation: the website, every subdomain, email delivery, and certificate renewals stop at the same time.
Many registries add a grace period, but redemption is expensive and some TLDs (for example .co.jp) simply delete the name.
Expired names are routinely picked up by squatters and resellers, which turns an outage into a permanent loss.

Registry coverage

IANA’s RDAP bootstrap does not list many country-code TLDs. The auditor falls back to WHOIS for those, but some registries (DENIC .de, SWITCH .ch, .nl) do not publish an expiration date at all and are reported as a WARNING so the owner can verify with the registrar and record the date in the expirationDate preference.
WHOIS answers are free text. A registry that changes its output format may stop being parsed; the resulting WARNING (301) is a prompt to review, not proof that the date is unavailable.
Registries rate-limit RDAP and WHOIS. Auditing the same domain many times per hour may yield an ERROR (500) until the limit resets.

Timing

Dates are compared with the day the audit runs, in UTC. A domain that expires later today is reported as expired.
Auto-renewal at the registrar does not change the date the registry publishes until the renewal is processed; a warning shortly before the auto-renewal date is expected.

Auditors

MCP Server

REST API

Domain Expiration Auditor

Resilience

Coverage

How it works

Preferences

What it audits

Output documentation

Risks and considerations

A lapsed domain is a full outage

Registry coverage

Timing

Resilience

Coverage

​How it works

​Preferences

​What it audits

​Output documentation

​Risks and considerations

​A lapsed domain is a full outage

​Registry coverage

​Timing

How it works

Preferences

What it audits

Output documentation

Risks and considerations

A lapsed domain is a full outage

Registry coverage

Timing