Microsoft Lost hotmail.co.uk and DHS Lost a Federal Domain — What WHOIS Reveals About Domain Expiry Risk and How Squatters Catch Dropped Domains

Domain expiry monitoring failed at some of the world's largest organisations — Microsoft lost control of hotmail.co.uk in 2003, the UK Parliament's official mobile site expired and was squatted in 2011, and the US Department of Homeland Security briefly lost a domain in 2023 — not due to sophisticated attacks but because the renewal process was not monitored, the reminder email went to a departed employee's inbox, or the credit card used for auto-renewal had expired

Domain registration is one of the most mature and routine parts of internet infrastructure maintenance, yet it remains one of the most common failure modes for organisations of all sizes. The systems that prevent domain expiry exist, the tooling is available, and the cost of renewal is trivial — which makes the failures more revealing about organisational failure modes than technical ones.

The RDAP transition and what modern WHOIS returns

WHOIS (the legacy protocol for domain registration data) has been gradually replaced by RDAP (Registration Data Access Protocol) since 2019, when ICANN mandated that all accredited registrars support RDAP.

What changed technically:

• WHOIS: an ancient plaintext protocol (RFC 954, 1985) that returns unstructured text — parsers must guess field positions
• RDAP: returns structured JSON — programmatically parseable, consistent across registrars, extensible

What changed for registrants:

• GDPR (2018) triggered WHOIS privacy redaction — most contact fields now show "REDACTED FOR PRIVACY" for non-commercial registrants
• RDAP preserved this redaction but added consistency to what's redacted vs what's exposed
• Registrar-specific data (nameservers, status codes, creation/expiry dates) remains consistently available even when contact data is redacted

What remains available even after redaction:

• Domain creation date
• Domain expiry date (the most security-critical piece of data for defenders)
• Last-updated date
• Registrar name
• Nameservers
• Domain status codes (ACTIVE, clientHold, serverHold, redemptionPeriod, pendingDelete)

Domain status codes and what they mean for defenders

EPP (Extensible Provisioning Protocol) status codes are machine-readable states that appear in WHOIS/RDAP output:

clientTransferProhibited: registrant-requested lock preventing unauthorised transfer to another registrar. All valuable domains should have this.

serverTransferProhibited: registrar-imposed lock. Added automatically for some TLDs, or manually for domains suspected of hijacking risk.

clientHold / serverHold: the domain is not active — DNS resolution is suspended. clientHold is set by the registrant (or their registrar). serverHold is imposed by the registry (often for regulatory or legal reasons). A domain on hold returns NXDOMAIN — it's effectively as if the domain doesn't exist.

redemptionPeriod: the domain has expired and the registration grace period has passed. The domain is in a 30-day redemption period where the original registrant can recover it for a significant redemption fee ($50-$200 depending on registrar). After this, the domain enters pendingDelete.

pendingDelete: the domain has completed the redemption period and will be deleted in approximately 5 days, after which it's available for registration by anyone. This is the status that domain squatters watch — they monitor pendingDelete domains and register valuable ones the moment they become available.

How domain squatters capture expired domains

The domain drop-catching industry has developed sophisticated infrastructure specifically to register valuable domains the moment they become available after deletion:

The deletion timeline:

1. Registration expires → 45-day grace period (registrant can renew at normal price)
2. Grace period ends → 30-day redemption period (redemptionPeriod status)
3. Redemption period ends → 5-day pendingDelete period
4. Deletion → domain available for registration

The drop-catching mechanism: multiple registrars (some specialising in drops) submit registration requests for the domain in rapid succession at the estimated deletion moment. The ICANN-coordinated deletion process means domains don't all drop at exactly the same second — there's some spread, and drop-catch services attempt to time registrations as precisely as possible.

Competitive drop services: platforms like DropCatch, SnapNames, and GoDaddy Auctions allow users to bid on expired domains before they drop, with the highest bidder getting the drop-catch attempt from that platform. Valuable expired domains (high DA, good backlink profiles, memorable names) attract competitive bidding.

What WHOIS reveals for due diligence

Before acquiring a domain, purchasing from a vendor whose site uses a specific domain, or evaluating a potential partner, WHOIS data reveals:

Domain age: creation date indicates how long the domain has been registered. A "10-year-old company" claiming a domain that was registered 18 months ago is a red flag — either the company is newer than claimed, or they recently lost the original domain and re-registered it.

Registrar history: if a domain was recently transferred between registrars (visible through transfer-related status codes or registrar changes), it may indicate ownership change or recovery after expiry.

Nameserver consistency: nameservers should match the domain's claimed hosting provider. Unexpected nameservers (pointing to competitors, or to generic parking nameservers) indicate the domain may not be actively serving its claimed content.

DNSSEC status: whether DNSSEC is enabled indicates a base level of DNS security hygiene — organisations with DNSSEC configured on their primary domain generally have more mature infrastructure security.

Implementing domain expiry monitoring

Effective domain monitoring requires more than checking the WHOIS expiry date occasionally:

Automated expiry alerting: most registrar control panels offer renewal reminders, but these go to the email address registered on the account — often an email alias that routed to a departed employee or an inbox nobody actively monitors. External monitoring services (UptimeRobot, Site24x7, Freshping, StatusPage — or purpose-built domain monitoring) provide alerts independent of the registrar's reminder system.

Multiple alert thresholds: alerts at 90 days, 60 days, 30 days, and 7 days before expiry — escalating recipients at each stage. A 90-day alert to the DNS administrator; a 7-day alert to the CTO and finance team.

Credit card expiry checking: auto-renewal failures are often caused by expired credit cards on the registrar account. The credit card expiry date should be checked against domain expiry dates — if the card expires before any domain does, update the payment method first.

Authoritative email address: the registrar account email should be a role-based alias ([email protected] or [email protected]) rather than an individual's personal address — ensuring the account remains accessible when team members leave.

How to use the WHOIS Lookup on sadiqbd.com

1. For pre-purchase domain due diligence: check creation date, current registrar, nameservers, and domain status before purchasing from a vendor or evaluating a partner — inconsistencies between claimed history and WHOIS data are meaningful signals
2. For expiry monitoring: run WHOIS on your own domains periodically to verify the expiry dates match your records and auto-renewal is configured correctly — particularly for secondary domains (brand protection registrations, legacy product domains) that may not be actively used but are strategically important
3. For competitive intelligence: domain creation dates and registrar data are publicly available even under GDPR redaction — understanding when a competitor's domain was registered, which registrar they use, and whether DNSSEC is enabled provides insight into their infrastructure maturity

Frequently Asked Questions

Can I register a domain before it expires if I want to acquire it from its current owner? No — you cannot register a domain that is currently active under someone else's registration. While the domain is active, its registration is exclusive to the current registrant. Your options are: (1) contact the current registrant and negotiate a purchase directly (WHOIS contact data, where available, or the registrar's domain brokerage service); (2) wait for the domain to expire and drop-catch it (risky — domain squatters may get it first); (3) use a domain marketplace (Sedo, Afternic, GoDaddy Auctions) to make an offer, which they forward to the registrant; (4) use a domain broker who handles negotiation on your behalf. For genuinely valuable domains held by inactive registrants, patient direct outreach often succeeds — many domain holders are willing to sell if the offer is reasonable.

Is the WHOIS Lookup free? Yes — completely free, no sign-up required.

Try the WHOIS Lookup free at sadiqbd.com — check any domain's registration details, expiry date, nameservers, and status codes.