Domain and DNS check: expiry date and DNSSEC

WebMeter shows for free when your domain registration expires, using the registry’s public RDAP data, and checks DNSSEC, name servers, CAA and IPv6 for the website and mail. If a domain lapses, the website and e-mail stop working and you can lose the address.

Updated 28 Oct 2026

How to find out when a domain expires

Where to find the expiry date:

With a WebMeter check. Reads the date from the registry’s RDAP and warns when the registration ends within 45 days, more urgently within 14. It also shows the registrar and domain statuses.
In WHOIS. Generic domains such as .com at lookup.icann.org, .cz domains at nic.cz.
In your registrar account. Only there do you see whether auto-renewal is on, the stored card is valid and where notices go.

The domain holder should be your company, not an agency.

Check your domain for free →

DNS records and registration: what a domain involves

A domain registration is paid for a fixed period, usually a year, and has to be renewed. The registry keeps the expiry date and publishes it via RDAP, the successor to WHOIS (for .com and other generic endings the official source since 28 January 2025). DNS records build on it:

Main DNS records and what WebMeter checks in them
Record	What it does	What WebMeter checks
NS	Name servers: where the website runs and where mail goes	How many and how they are spread across networks
A and AAAA	The website’s address (IPv4 and IPv6)	IPv6 for the website and RPKI for its address
MX	Mail servers	IPv6 for the mail servers
TXT (SPF, DMARC), TXT or CNAME (DKIM)	Protecting e-mail against spoofing	Separate SPF, DKIM and DMARC area
CAA	Which certificate authorities may issue an HTTPS certificate (checked by them since September 2017)	Whether it exists and the lookup doesn’t fail. The certificate itself: SSL certificate check.
DS and DNSKEY	Signature on the records (DNSSEC)	See DNSSEC
TLSA (DANE)	Binds the certificate to DNS	Only recorded

DNSSEC: what it is and how to verify it works

DNSSEC is an electronic signature on DNS records. A validating resolver recognises a forged answer and rejects it. It isn’t mandatory for a company domain, but once switched on, it has to work.

What WebMeter verifies: whether the domain is signed, whether resolvers accept the signature and which algorithm is used. A broken signature is double-checked with a second, independent resolver.
Who switches it on: whoever runs your DNS signs the zone; the registry then publishes the DS record, submitted through your registrar.
The most common mistake: after a change of DNS provider, an old DS record stays at the registry and the signature no longer matches. Plan moving a signed domain with both providers.

How WebMeter rates DNSSEC errors is shown in the table under What we check.

Why the domain and DNS matter for a small business

The domain is the address of your website and of every company e-mail. If nobody renews the registration, the registry takes it out of service after a grace period: the website won’t load and mail to your addresses won’t be delivered. If it still isn’t renewed, the domain is deleted and anyone can register it. The new holder can then receive e-mails meant for you or run their own website at your address.

Broken DNSSEC causes a quieter outage: validating resolvers reject the answer, so some visitors can’t reach the website or e-mail while everything works at the office. A single name server is one point whose failure takes the whole domain down.

A reliable domain and DNS are also part of the basic cyber hygiene covered in our guide to the NIS2 cybersecurity rules.

Domain expiry and other domain and DNS problems

The domain was once registered by a web agency or a former employee, and expiry notices go to an address nobody reads.
Auto-renewal isn’t switched on, or the payment fails because the card has expired in the meantime.
The domain has only one name server, or all of them sit in one network.

Domain DNS check: what is covered

WebMeter reads only public sources: DNS via Google’s DNS over HTTPS (a broken DNSSEC signature is double-checked with Cloudflare), the registry’s RDAP and routing data from RIPEstat. It sends nothing to your domain’s servers. Findings are rated as follows:

Findings in the Domain and DNS area and their severity
Finding	Severity
Registration expired, or the registry took the domain out of service or lists it for deletion	Critical
Registration expires within 14 / 45 days	High / medium
DNSSEC switched on but broken	High, critical if a second resolver confirms it
Resolvers can’t validate the signed domain	Medium
DNSSEC not active	Low
Outdated DNSSEC algorithm	Medium (prohibited) or low (not recommended)
Only one name server / all in one network	Medium / low
CAA lookup fails DNSSEC validation	High
No CAA, website or mail without IPv6	Low
RPKI: route to the website’s address invalid	High
Registrar, statuses, transfer lock, DANE	Only stated

How the findings make up the score is explained in the measurement methodology.

WebMeter doesn’t see your registrar account, so it can’t tell whether auto-renewal is on. It measures the state at the moment of the check, not DNS availability over time. SPF, DKIM and DMARC are rated by the separate SPF, DKIM and DMARC check. Dangling DNS records and subdomains from certificate logs are covered by the website exposure check.

Check your domain and DNS for free

Enter a domain and see when its registration ends (if the registry publishes it) and how its DNS is doing, along with the other areas.

Check your domain for free →

Not sure what to make of the result? We offer a no-obligation consultation. Just write to kontakt@webmeter.eu.

Website design including domain and DNS setup

We build the new website from scratch and set up the domain and DNS with it: registration, name servers and the records for website and email. Website, domain and email then come from one supplier.

How website design works → Case study: from 73 to 97 points →

Frequently asked questions about domains and DNS

What happens when a domain registration expires?

The domain usually doesn’t stop working straight away. Registries allow a grace period during which the registration can still be renewed. After that the domain is taken out of service and the website and e-mail stop working. If nobody renews it, the registry deletes it and someone else can get the domain.

Why doesn’t WebMeter show an expiry date for my domain?

It reads the date from RDAP, the registry’s public interface. Some registries don’t provide it, for example those for “.eu”, “.de”, “.sk” or “.es”, and WebMeter then reports nothing. The same applies to an address on a provider’s domain.

Is DNSSEC mandatory?

Not for an ordinary company domain. WebMeter rates missing DNSSEC as low severity. DNSSEC that is switched on but broken is worse than none, because some resolvers stop resolving the domain. That’s why WebMeter rates it as high severity, and as critical when two independent resolvers confirm the error.

What is a CAA record and do I need one?

CAA states which certificate authorities may issue an HTTPS certificate for the domain. It isn’t mandatory, but without it any authority may issue one. If the domain has it, it must list every authority it gets certificates from, including those chosen by your hosting or CDN, or renewal will fail.

An agency registered our domain. How do I find out who owns it?

The WebMeter check shows the registrar and statuses; the holder is shown by the registrar or the registry’s WHOIS where it is public. If it isn’t your company, ask the supplier to change the holder to your company before the registration expires.

Other areas checked

How the check treats your website is described on the page about the WebMeterBot robot; what is stored and for how long is in the data processing policy.