Skip to content
allanninal.dev/build
Collaborate

Part 1 of 7 · Domain renewal watcher series ~6 min read

A domain renewal watcher on AWS for a few dollars a month

A domain lapsing is one of the very few failures in a small business that takes the whole thing off the internet at once: the site, the email, the logins that use that email to reset. It happens to somebody every week, and almost never because nobody knew. It happens because the reminder went to a person who left in 2023, or the card on file expired, or the domain was registered by an agency who stopped invoicing. This post walks through a small system built around that.

Five men working at wooden desks in a sunlit office with filing cabinets
Photo by Smithsonian on Unsplash

Key takeaways

  • The expiry comes from the registry, not from a registrar email or dashboard.
  • A domain register is a short list and almost nobody has one.
  • Three discovery paths find the domains you forgot: certificates, DNS, and card charges.
  • Escalation goes to people who currently work here, not to whoever bought the domain.
  • Designed on AWS for about $1 a month.

The whole system on one page

Before any code, here is the shape of what we are designing.

System: registries checked against a register, escalation outThree boxes across the top sit outside the AWS account. On the left, The registries: queried over RDAP, which is the authoritative source. In the middle, Domain register: what you own and who owns it internally. On the right, Whoever pays, and their manager. Each connects by an arrow to the AWS account container below. Real expiry dates flow down into the account. The register feeds in what to check. Renewal escalations go back out. Inside the AWS account are three components in a row. On the left, the Checker, which runs weekly per domain against the registry. In the middle, Discovery, which finds domains that are not on your list. On the right, the Escalator, which acts at ninety, thirty and seven days and then loudly. A note at the bottom says it cannot renew anything, because that needs a payment credential it deliberately lacks.AWS ACCOUNTThe registriesRDAP, the truthDomain registerwhat you own, who owns itWhoever paysand their managerCheckerweekly, per domain,against the registryDiscoveryfinds domains noton your listEscalator90, 30, 7 days,then loudlyreal expiry dateswhat to checkrenew this, bywhenIt cannot renew anything. That needs a payment credential it deliberately lacks.
Fig 1. Three things outside the account, three pieces inside it. Discovery sits in the middle because the domains that lapse are disproportionately the ones that were never on anybody’s list.
  • Networking
  • Management
  • Analytics
  • People

Why the registry rather than the registrar

A registrar’s dashboard shows what the registrar believes about your domain. The registry — the organisation that actually runs the top-level domain — shows what is true. Those two agree almost all of the time, and the times they disagree are exactly the times you need to know.

A renewal that was taken from an expired card shows as renewed in the registrar’s billing view and unchanged at the registry. A transfer in progress can show a date at one and a different date at the other. A registrar that has been acquired frequently has stale records for months. Querying the registry directly, over RDAP, costs nothing and removes the whole class.

What runs weekly (the inside)

  • The checker. Queries the registry for each registered domain and records the expiry, the registrar, the nameservers and the status codes. Part 2 covers RDAP and what to do about the registries that do not offer it.
  • Discovery. Looks for domains you depend on that are not in the register. Three sources, covered in Part 3, and between them they typically find two or three domains per business that nobody had written down.
  • The escalator. Ninety days, thirty days, seven days, and then daily. It escalates to people from your staff list rather than to whatever address is on the registration, which is the single most important thing it does.

One domain, end to end

One domain from register to renewal escalation, in five stagesA horizontal row of five boxes joined by arrows. Registered: it is in your list. Checked: weekly, at the registry. T minus ninety: a quiet note. T minus thirty: the owner and their manager. T minus seven: daily until it moves. A note says ninety days is not early, because transfers and payment problems both take weeks.ONE DOMAIN, END TO ENDRegisteredin your listCheckedweekly, at the registryT-90a quiet noteT-30and their managerT-7daily until it movesNinety days is not early. Transfers and payment problems both take weeks.
Fig 2. The same system as one line. Starting at ninety days sounds excessive until a renewal fails and the fix turns out to involve a registrar support queue.
  • App integration
  • Management
  • Analytics

In plain words

A business has eleven domains. Three are obvious: the main one, the .co.uk that redirects, and one for a product. Four more are found by discovery: two that were bought for campaigns years ago and still have MX records pointing at the mail provider, one that an agency registered and never transferred, and one that a former employee bought on a personal card and expensed.

That last one is the interesting case. It is the domain used for a customer-facing portal. It was registered to a personal email that no longer exists, paid for with a card that was cancelled when the person left, and expires in five months. Every registrar reminder it will ever send is going to a dead address. Discovery finds it because it appears in a certificate transparency log for a hostname the business uses; the checker gets its real expiry from the registry; and at ninety days somebody who still works there is told, with enough time to transfer it rather than to argue about it during a redemption period.

Design rules that shaped every decision

  • Check the registry, not the registrar. One tells you the truth and the other tells you what it believes.
  • Escalate to your staff list. The address on a registration is the least reliable place to send a warning.
  • Ninety days is the first notice. Transfers, payment fixes and registrar support all take weeks.
  • It cannot renew. A system that can spend money on a card needs a security posture this does not have.
  • Discovery is a first-class feature. The domains that lapse are the ones nobody listed.
  • Watch the status codes, not just the date. A domain can be locked, on hold or pending deletion well before it expires.

Why this shape

The reason this is worth building rather than putting eleven dates in a calendar is that the dates are not the problem. The problem is that domains accumulate at the edges of a business — bought by agencies, by former staff, for campaigns — and the ones at the edges are both the least visible and the most likely to have a broken payment path attached.

So the system spends about half its effort on discovery and about half on making sure the warning reaches somebody who exists. The actual date check is a weekly HTTP request per domain, and it is the least interesting part.

The next four posts walk through each piece: how a registry lookup works, how domains get discovered, what the status codes mean, and how the escalation runs. One diagram per post, a cost breakdown, and an engineering reference at the end.

All posts