First CH Apps / Domain Expiry Checker (WHOIS & RDAP Lookup)
Enter a domain to see how many days are left until it expires, with renewal and suspension warnings first.
Enter a domain name and our server queries RDAP — the HTTPS API that replaces WHOIS — for the registrar, creation date, expiry date, statuses and name servers. The RDAP server for gTLDs is resolved through the IANA bootstrap (RFC 9224).
The number that matters is how many days are left. When a domain expires the website and the email stop together, and getting it back costs more than a renewal. We never fetch or display registrant or admin contacts — only the registrar, which is a company.
e.g. example.com (a full URL, an email address or a www host all work — we fold them down to the registrable domain)
The expiry date, days left and the time of your last check stay in this browser only (nothing is stored on our server). Next time, re-check them from this list.
Open the topic you need.
Type the domain (example.com) into the box above and press Check expiry. The large number is the days left until the expiration date the registry publishes in RDAP, and the Expires row shows that date in UTC. A full URL or a www host is folded down to the registrable domain, because registration data exists only at that level. For country-code TLDs without RDAP, such as .jp, we cannot read the date and link you to the registry's WHOIS search instead. Renewal itself is always done at your registrar — this page only reads the data.
A future expiry date does not prove the domain is healthy. On many gTLD registries, including .com and .net, the registry renews the domain automatically on its expiry date and moves the date forward a year; the registrar then has a grace period (autoRenewPeriod) to delete it if the owner does not pay. So a domain that lapsed last week can show an expiry date next year. If the statuses include autoRenewPeriod, redemptionPeriod or pendingDelete, the domain has passed its expiry, and clientHold means it has stopped resolving whatever the date says.
You can paste an email address; we look up the part after the @. For free mail services such as outlook.com or gmail.com, the result is the provider's own domain registration, so it tells you nothing about whether a particular mailbox exists — no registration lookup can verify that. To see whether a domain is set up to receive and authenticate mail, check its MX, SPF and DMARC records with the Email DNS Checker listed under “What to check after the expiry date”.
When a domain expires, the website and the email stop at the same time. ICANN's Expired Registration Recovery Policy (ERRP) requires gTLD registrars to send renewal reminders approximately one month and one week before expiry and again within five days after it, and to interrupt DNS resolution for at least the last eight days before deletion. The registrar decides the exact day, so the outage and the expiry date rarely line up and the cause takes a while to find. The reminders go to the registered contact, so make sure it is not the mailbox of someone who has left. Once you are inside 30 days, confirm that auto-renew is enabled and that the credit card on file with the registrar has not itself expired.
clientHold is the registrar holding the domain: the name servers are pulled from the registry and resolution stops completely. Besides unpaid invoices, it can follow an unanswered contact verification: the WHOIS Accuracy Program Specification of ICANN's 2013 Registrar Accreditation Agreement requires registrars to verify contacts within 15 days of a registration, transfer or change of registrant, and, when a contact change gets no affirmative response within 15 days, to verify manually or suspend the registration. Those verification emails are often filtered as spam, so check the contact verification state in your registrar's control panel.
Domain hijacking usually works by getting into the management account and transferring the domain away. A transfer lock blocks that step. Leave it enabled and lift it only when you genuinely move the domain, and put two-factor authentication on the registrar account as well.
After expiry a registrar may offer a renewal grace period (1–45 days according to ICANN; shown as autoRenewPeriod), and once the domain is deleted it enters a 30-day redemptionPeriod that ERRP requires every gTLD registry to offer. Recovery is still possible during redemption, but there may be a restore fee that exceeds a normal renewal. Once the domain reaches pendingDelete the registration is lost and anybody can register the name. If you see these statuses, call your registrar the same day.
RDAP is the successor to WHOIS: it returns JSON over HTTPS (RFC 9083 and 9224). ICANN requires gTLD registries and registrars to run RDAP and ended the obligation to run WHOIS (port 43 and web-based WHOIS) on 28 January 2025. Country-code TLDs are outside that requirement, which is why registries such as .jp still offer WHOIS only. This page queries RDAP for gTLDs and points you at the registry's WHOIS search when RDAP is unavailable.
Sent: only the domain name you type (subdomains are folded down to the registrable domain). Our server (Cloudflare Workers) makes at most two HTTPS GET requests: one to the IANA bootstrap (data.iana.org) and one to that TLD's registry RDAP server. For TLDs without RDAP we send a single NS query to Cloudflare's public DNS (1.1.1.1).
Stored: nothing on our server. The lookup lives entirely inside one request and writes neither the domain nor the result to any database (no KV, no D1). It leaves memory when the request ends.
Kept on this device: only when you press “Watch on this device”, the domain, its expiry date and the time you checked it are kept in this browser's localStorage (up to five domains). They are never sent to our server, except that “Re-check all” sends each domain name one by one, exactly like a normal lookup. “Remove”, “Remove all” or clearing browser data deletes them. The calendar .ics file is also built on this device.
Returned: the registrar name, IANA number, dates, statuses, name servers and DNSSEC flag we read out of RDAP, plus our assessment. The raw RDAP response (notices, remarks and so on) is never relayed.
Not read: registrant, administrative and technical entities (names, addresses, phone numbers, email). Some country-code TLDs include personal data in RDAP; because we do not handle personal data, we read only the registrar (a company) and its abuse contact.
Note: the only servers we query are the registry servers named by the IANA bootstrap — there is no way to point this app at an arbitrary URL. localhost, internal domains (.internal, .local) and IP addresses are rejected.
POST /domain-info/api/lookup with JSON ({"domain": "example.com"}) or a form body and you get the same result as JSON (no auth, nothing stored).
