> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Expiration Auditor

> Looks up the registrable domain's expiration date over RDAP or WHOIS and warns before it lapses

<Info>
  **Resilience Auditor** — looks up when the site's domain registration expires and flags renewals that are due.
</Info>

<CardGroup cols={2}>
  <Card title="Resilience" icon="shield">
    A lapsed domain takes the whole site, its email, and its certificates offline at once.
  </Card>

  <Card title="Coverage" icon="globe">
    RDAP where IANA lists a service, WHOIS everywhere else (.jp, .de, .cn, .io, .st, …).
  </Card>
</CardGroup>

This auditor extracts the hostname from the audited URL, asks the domain registry for the registration's expiration date, and grades how many days remain. It never touches the web server: the answer comes from the registry, so the check works even when the site is down.

## How it works

1. **Parse** — takes the hostname of the audited URL and drops a leading `www.`.
2. **RDAP** — resolves the registry's RDAP server from IANA's bootstrap file and queries it. The `expiration` event supplies the date.
3. **WHOIS fallback** — when the TLD has no RDAP service, when the RDAP answer carries no expiration event, or when the RDAP request fails, the auditor asks IANA for the registry's WHOIS server and parses the port-43 answer. It understands the common registry formats (Verisign, JPRS, CNNIC, nic.st, TCI, Nominet, Registro.br).
4. **Subdomains** — when a registry answers "not found" for `help.example.co.jp`, the auditor drops the leading label and retries with `example.co.jp`, down to the last two labels.
5. **Preference** — when the registry publishes no date, or no registry answers, the `expirationDate` preference (if set) is graded instead. When the registry does publish a date, that date is graded and a preference that differs from it adds a WARNING.
6. **Rules** — expired and expiring-within-30-days are separate FAILs; expiring-within-90-days and expiration-not-published are WARNINGs; no answer from any registry is an ERROR.
7. **Aggregate** — `ERROR` wins, then `FAIL`, then `WARNING`; when every rule passes the audit is `SUCCESS`.

Each check carries `domain`, `queried_domain`, `source` (`rdap`, `whois`, or `preference`), `server`, and, when known, `expiration_date` and `days_until_expiration`. A date taken from the preference after every lookup failed also carries `lookup_errors`; the conflict warning also carries `preferred_expiration_date`.

## Preferences

| Key | Type | Default | Description |
| - | - | - | - |
| `expirationDate` | date (`yyyy-MM-dd`) | none | The expiration date the owner tracks by hand, set per monitored URL on the **Configuration** tab. Used when the registry publishes no date (for example DENIC for `.de` or SWITCH for `.ch`) or cannot be reached. The registry date always takes precedence. |

A value that is not a `yyyy-MM-dd` date is ignored and logged. A date from the preference is graded with the same thresholds as a registry date, so a forgotten preference turns into a FAIL once that date passes: update it after each renewal.

## What it audits

Every row maps to one `checkRule*` method and one `CheckCode`. CheckCode suffixes use status ranges: `200` success, `300–399` warning, `400–499` fail, `500–599` error.

| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| <a id="37A-DomainExpirationAuditor-500" />`37A-DomainExpirationAuditor-500` | `ERROR` | No registry answered for any candidate name, both the RDAP and WHOIS lookups failed, or the URL has no hostname, and the `expirationDate` preference is not set. | Confirm `{host}` is a registered domain and that the registry for `.{tld}` is reachable. | — |
| <a id="37A-DomainExpirationAuditor-400" />`37A-DomainExpirationAuditor-400` | `FAIL` | The expiration date is today or in the past. | Renew `{domain}` with your registrar immediately; it expired on `{expiration_date}`. | An expired domain takes the website, every subdomain, email delivery and certificate renewals offline at once, and after the grace period the name can be deleted or bought by someone else. |
| <a id="37A-DomainExpirationAuditor-401" />`37A-DomainExpirationAuditor-401` | `FAIL` | The domain expires in 1 to 30 days. | Renew `{domain}` before `{expiration_date}`; only `{days_until_expiration}` day(s) remain. | Once the registration lapses, the website, email and certificates go offline together, and with so little time left a failed payment or a locked registrar account turns into a real outage. |
| <a id="37A-DomainExpirationAuditor-300" />`37A-DomainExpirationAuditor-300` | `WARNING` | The domain expires in 31 to 90 days. | Schedule the renewal of `{domain}` before `{expiration_date}`. | Once the registration lapses, the website, email and certificates go offline together; a renewal that fails at the last minute because of an expired card or a locked registrar account leaves no time to recover. |
| <a id="37A-DomainExpirationAuditor-301" />`37A-DomainExpirationAuditor-301` | `WARNING` | The registry answered but publishes no expiration date (for example DENIC for `.de` or SWITCH for `.ch`), and the `expirationDate` preference is not set. | Verify the renewal date of `{domain}` with your registrar and set it in the Expiration date preference. | Without an expiration date nobody is warned before the registration lapses, and a lapsed domain takes the website, email and certificates offline at once. |
| <a id="37A-DomainExpirationAuditor-302" />`37A-DomainExpirationAuditor-302` | `WARNING` | The registry publishes an expiration date that differs from the `expirationDate` preference; the registry date is the one graded. | Update the Expiration date preference to `{expiration_date}`, or clear it since the registry publishes the date. | A tracked date that disagrees with the registry usually means the renewal was recorded wrong, so the owner may plan around a date that is not the one the domain actually expires on. |
| <a id="37A-DomainExpirationAuditor-200" />`37A-DomainExpirationAuditor-200` | `SUCCESS` | All rules passed; message is `Domain {domain} is valid until {expiration_date} ({days_until_expiration} days), looked up via {source}` (or `as set in the Expiration date preference`). | — | — |

## Output documentation

| Status | Description | Test logic |
| - | - | - |
| **SUCCESS** | The registration is valid for more than 90 days | `days_until_expiration > 90` (`200`). |
| **WARNING** | The renewal is due soon, the registry hides the date, or the preference disagrees with the registry | 31–90 days left (`300`); registry publishes no expiration date and no preference is set (`301`); registry date differs from the `expirationDate` preference (`302`). |
| **FAIL** | The registration has lapsed or is about to | `days_until_expiration <= 0` (`400`); 1–30 days left (`401`). |
| **ERROR** | The auditor could not consult a registry and no preference is set | Every candidate name was "not found", or both RDAP and WHOIS failed (`500`). |

## Risks and considerations

### A lapsed domain is a full outage

* When the registration expires the registry removes the delegation: the website, every subdomain, email delivery, and certificate renewals stop at the same time.
* Many registries add a grace period, but redemption is expensive and some TLDs (for example `.co.jp`) simply delete the name.
* Expired names are routinely picked up by squatters and resellers, which turns an outage into a permanent loss.

### Registry coverage

* IANA's RDAP bootstrap does not list many country-code TLDs. The auditor falls back to WHOIS for those, but some registries (DENIC `.de`, SWITCH `.ch`, `.nl`) do not publish an expiration date at all and are reported as a WARNING so the owner can verify with the registrar and record the date in the `expirationDate` preference.
* WHOIS answers are free text. A registry that changes its output format may stop being parsed; the resulting WARNING (`301`) is a prompt to review, not proof that the date is unavailable.
* Registries rate-limit RDAP and WHOIS. Auditing the same domain many times per hour may yield an ERROR (`500`) until the limit resets.

### Timing

* Dates are compared with the day the audit runs, in UTC. A domain that expires later today is reported as expired.
* Auto-renewal at the registrar does not change the date the registry publishes until the renewal is processed; a warning shortly before the auto-renewal date is expected.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.