All tools

Guides Domains

Is this domain expiration email a scam?

Updated 7 min read

Short answer

Probably, if it isn’t from the registrar you pay. Never pay or sign in through the email: look up the real expiry date at the registry, then renew inside your own registrar account.

Only your registrar, or the reseller you pay, can renew your domain. A “renewal” sold by anyone else turns out to be something else: a listing, an ad, or a transfer of your domain to them.

What to do: check the email in two minutes. Already clicked, signed in or paid? Here is what to do next.

Not sure when your domain really expires? The domain expiration checker reads the date, the registrar and the statuses straight from the registry. Free, no account. Check a domain

Check it in two minutes

Don’t use anything in the email: no links, no phone numbers, no “reply to renew”. Check it against two sources the sender doesn’t control.

  1. Look the domain up at its registry. The registry is the organization that runs the ending (Verisign for .com), and it knows the real expiry date and which registrar manages the domain. The domain expiration checker shows both, or ask over RDAP yourself:
curl -sL https://rdap.org/domain/wikipedia.org | jq -r '
  "Registrar: " + (.entities[] | select(.roles | index("registrar"))
    | .vcardArray[1][] | select(.[0] == "fn") | .[3]),
  "Expires:   " + (.events[] | select(.eventAction == "expiration")
    | .eventDate),
  "Status:    " + (.status | join(", "))'
Registrar: MarkMonitor Inc.
Expires:   2027-01-13T00:12:14Z
Status:    client delete prohibited, client transfer prohibited, client update prohibited

Captured on October 23, 2026 with curl 8.7.1 and jq 1.7.1. For a .com, whois still answers too: look for Registrar: and Registry Expiry Date:. RDAP vs WHOIS explains both.

  1. Compare the sender with that registrar. An email from a different company, or from a name that only resembles your registrar’s, is the first warning sign. A familiar name and logo prove little, because phishing emails copy them. If the registry names a company you’ve never heard of, you may have bought the domain through a reseller, such as your web host; then the reseller is the one who bills you.

  2. Compare the dates. Under ICANN’s Expired Registration Recovery Policy, your registrar must remind you about a month before expiry (26–35 days counts) and about a week before (4–10 days), and once more within five days after it if you haven’t renewed. Registrars may send extra reminders, so the timing alone proves nothing. An email that says your domain expires today, when the registry says next year, is wrong about something.

  3. Go to your registrar yourself. Type its address or use a bookmark, sign in, and look at the domain’s renewal date and auto-renew setting there. If it needs renewing, renew it there. The registry’s date can run ahead of your registrar’s (why), so the registrar’s account is the one to trust for whether you’ve paid.

As the FTC puts it, “legitimate companies won’t email or text with a link to update your payment information” (How to recognize and avoid phishing scams).

The four patterns

Fake expiry emails tend to follow one of four patterns. Each one below comes from an ICANN warning or an FTC case, the oldest from 2003.

  • An invoice for something else. In 2010 the FTC halted Internet Listing Service, whose invoices “appeared to come from the businesses’ existing domain name registrar” and billed for an annual “WEBSITE ADDRESS LISTING”, with search engine optimization thrown in. Most of the people who paid got no domain registration services at all. An invoice for a “listing”, “SEO submission” or “directory” that mentions your domain is this pattern.
  • A renewal that is really a transfer. In 2003 the FTC settled with Domain Registry of America, whose mailers looked like “renewal notices or invoices” from people’s current registrars. Paying the “renewal” moved the domain to another registrar.
  • A sign-in page dressed as your registrar. ICANN’s security committee described it in 2008: an email that looks like your registrar’s, for example “a notice of pending expiration”, links to a copy of its login page. The password you type there lets the phisher “alter DNS information”, which can point your website and email somewhere else. The same trick works with a page made to look like your email provider’s sign-in, such as Microsoft 365 or Google.
  • ICANN’s name on it. ICANN has warned about renewal offers that “appear to be sent by ICANN”. ICANN “does not process domain registrations or collect fees from registrants directly”, and it doesn’t email registrants about managing their domains. Any expiry or payment email signed by ICANN is fake.

The emails that are real

Some legitimate emails look alarming too. These come from your registrar (or the reseller you pay), never from a stranger:

  • Expiry reminders: about a month and a week before expiry, and one within five days after if you haven’t renewed. Registrars must describe on their websites how they send these and to which contact, and the policy suggests they name the address the reminders come from, so you can check it.
  • A yearly request to check your contact details. The Registration Data Reminder Policy makes registrars show you your registration data at least once a year and remind you that false contact details “can be grounds for cancellation”. Phishers imitate this one too, so answer it inside your registrar account, not through the email.
  • Notices from your registrar’s own systems: a transfer request, a change of name servers, a receipt. If you didn’t ask for the change, sign in to your registrar and contact its support.

If you clicked, signed in or paid

  • You paid by card. Report it to the card issuer straight away, using the number on the back of the card or its app, and ask for your money back. That is the FTC’s advice in What to do if you were scammed.
  • You signed in on the page. Change that password on the real site now, turn on two-factor authentication, and change it anywhere else you used it (the FTC’s advice again). If it was your registrar password, also check in your registrar account that the domain’s name servers and contacts are unchanged and that the transfer lock is still on. In a lookup it shows as client transfer prohibited; domain status codes explains it.
  • A transfer you didn’t ask for has started. ICANN’s advice for the pendingTransfer status is to “contact your registrar immediately to request that they deny the transfer request” (EPP status codes).
  • You clicked but typed nothing. Update your security software and run a scan, as the FTC suggests.
  • Report it. Forward the email to the Anti-Phishing Working Group at reportphishing@apwg.org, and in the US report it at ReportFraud.ftc.gov. If it used ICANN’s name, ICANN asks you to forward it to globalsupport@icann.org with “suspected phishing” in the subject line.

Then make the real deadline hard to miss. Your registrar’s reminders go to the registrant email address on the domain (ICANN’s summary for registrants), so keep it current. If that address is on the domain itself, add a second one somewhere else, as the policy recommends: an expired domain can take its own mailbox down with it. What happens when a domain expires has the timeline.

Sources

All sources were checked on October 23, 2026. The lookup output comes from our own run on that date.

Keep reading