The email says your company’s domain expires today. The button is red, the warning is urgent and the invoice looks official. That still does not prove the message came from your registrar.
A domain expiry is a genuine operational risk. It can disrupt a website and email and, if the registration is eventually released, another person may register the name. That urgency is also exactly what makes renewal notices useful to scammers.
The safe response is not to ignore every warning. It is to verify the domain independently before paying or signing in.
Start from the registrar account, not the message
Do not use the link or phone number in an unexpected renewal notice. Open the registrar’s official website from a saved bookmark or type the known address yourself. Sign in and check the domain status, expiry date, renewal price, payment method and account contact details.
If you do not know the registrar, use ICANN Lookup for a generic top-level domain or the relevant registry’s lookup service. A web designer, hosting reseller or agency may manage the domain, but the business should still know where it is registered and who controls the account.
An invoice from an unfamiliar company may be an advertisement for a transfer, search listing or unrelated service rather than a renewal from the actual registrar. Read what is being sold.
Confirm ownership and recovery before payment
The registrar account should use an email address the business controls—not the private email of a former employee, contractor or agency. Check the recovery email, telephone number, two-factor authentication and authorised users.
Use a unique password and enable the strongest multi-factor option available. Store recovery codes in a controlled business password manager or other secure location separate from one person’s phone.
Critical domains should have at least two accountable administrators, but not a shared login passed around a WhatsApp group. Named access makes changes traceable and easier to remove when staff or vendors leave.
Understand the dates and prices
ICANN says registration is generally for a defined period, commonly one to ten years. Continued use requires renewal. Renewal options and fees, including charges after expiry, vary by registrar.
The low price paid in the first year may have been promotional. Check the normal renewal fee, taxes, privacy service and any optional products before approving payment. Do not assume that hosting, email, SSL certificates and domain registration expire together; they can be separate services with different providers and dates.
Take a screenshot or export the official invoice after logging in, then retain the payment receipt. Confirm that the expiry date actually moves forward inside the registrar account.
Use auto-renewal carefully
Auto-renewal can prevent an avoidable lapse, but only if the payment method and contact details remain current. Turn it on for critical domains where the registrar and business policy support it. Then create independent calendar reminders 60, 30 and seven days before expiry.
Do not treat auto-renewal as proof that renewal succeeded. Cards expire, banks decline online transactions and account restrictions happen. Check the confirmation and updated date.
If the domain has already expired
Act through the registrar immediately. Do not wait to see whether the website returns by itself.
ICANN requires specified renewal reminders for covered generic domains and describes a 30-day Redemption Grace Period after deletion in applicable cases. Restoration during redemption can carry an additional fee. After redemption, a domain may enter Pending Delete and later become available to others.
This lifecycle does not mean every domain extension follows identical timing. Country-code domains, including .ng names, may operate under registry-specific policies. Ask the registrar for the exact status, restoration route, fees and deadline in writing.
If email is affected, tell staff not to switch casually to personal addresses for sensitive work. Establish a verified temporary contact channel, warn customers through existing trusted channels and watch for impersonators exploiting the outage.
Separate the domain from the website
The domain is the address. Hosting is where website files and services run. DNS connects the address to the website, email and other systems. A business can therefore have an active domain with broken hosting, or working hosting that no longer receives visitors because the domain expired or DNS changed.
Before blaming renewal, check:
- domain status and expiry date;
- nameservers and recent DNS changes;
- hosting account and server status;
- email service and mail records;
- SSL certificate status;
- billing notices inside each official provider account.
Do not allow an unverified support caller to change nameservers, provide an transfer authorisation code or install remote-access software.
Build a domain continuity record
Every Nigerian small business with a website should keep a simple register containing:
- the exact domain name;
- registrar and registry;
- registration and expiry dates;
- account owner and backup administrator;
- recovery method location;
- auto-renewal status and payment owner;
- hosting and email providers;
- nameservers and DNS manager;
- agency or technical contact;
- last renewal receipt;
- escalation procedure if access is lost.
Review it quarterly and whenever a staff member, agency or payment card changes. Keep the record secure; it should not expose passwords or full payment details.
Nigeria-specific risks
Many businesses let a developer or agency register the domain during a website project. The arrangement becomes dangerous when the business does not know the registrar, the legal registrant information or the recovery email.
Ask for documented access while the relationship is healthy. The domain should not be held hostage to a maintenance dispute. At the same time, do not make an unauthorised transfer or change ownership without resolving the underlying agreement.
Beware of urgent naira invoices sent through WhatsApp by someone using a familiar business name. Confirm through the registrar dashboard and a previously verified contact. Never send an OTP, password or transfer code to a person claiming they need it to “renew from the backend”.
Frequently asked questions
Will the domain return immediately after renewal?
It may take time for the registrar and DNS systems to restore service. ICANN says a renewed domain should be made operational as soon as commercially reasonable. Ask the registrar for status if it remains unavailable.
Can I transfer an expired domain?
ICANN states that expiration alone should not prevent transfer in covered cases, but a domain already in Redemption Grace Period generally must first be restored by the current registrar. Policies vary, so confirm the status.
Is the renewal email definitely fake if it comes from a different company?
Not necessarily, but it may be a reseller, transfer offer or unrelated service. Verify the actual registrar and product independently before paying.
Continue reading on Tech Embed
- The 3-2-1 backup plan for Nigerian small businesses
- How Nigerian small businesses can choose software without wasting money
Topic hub: Explore more in Cybersecurity in Nigeria.
