Years ago, early in my time managing domains, I lost one. Not a throwaway — a trading business’s .com.au, with years of history, inbound links, and the company’s email running on it. Nobody did anything dramatic. That is the point: nobody did anything. The renewal notices went to an ex-employee’s mailbox, the card on file had expired, and the domain slid through every stage of the expiry lifecycle in complete silence until, one Tuesday morning, the website was gone, the email was bouncing, and the name belonged to someone else by lunchtime — caught, the instant it dropped, by an automated service working for a buyer who wanted it.
Everything in this article is what I wish I had understood before that Tuesday. The .au lifecycle is well-defined and entirely survivable — if you know where the stages are and how little time some of them give you.
Key takeaways
- A .au domain does not die on its expiry date — it enters a roughly 30-day expired hold during which the registrant can still renew it.
- It usually stops working at expiry, though: websites and email on the domain go down long before the name is actually deleted.
- After the hold period, the name is purged and published on the daily drop list, where drop-catching services compete to re-register it the moment it becomes available.
- Once a drop-catcher takes it, your realistic options are buying it back at the new holder’s price or a formal dispute — both far more expensive than a renewal.
- Prevention is boring and nearly free: current contact details, multi-year registrations, calendar reminders, and auto-renew with a working card.
The .au domain lifecycle, stage by stage
Exact operational details vary a little between registrars, but the shape of the lifecycle is set by auDA’s rules and the .au registry. Here is the whole arc.
Stage 1: The licence period
A .au licence runs for one to five years, with an exact expiry date you can check for any domain on the official auDA WHOIS (whois.auda.org.au). Throughout this period your registrar is required to send renewal reminders to the registrant’s contact email as expiry approaches.
Read that last sentence again, because it is where my domain died: reminders go to the registrant contact on file. Not to “the business” in any abstract sense. Not to whoever cares most. To one email address, set years earlier, that nobody may be reading.
Stage 2: Expiry day
If the renewal is not paid by the expiry date, the domain expires. Two things are true simultaneously, and the difference between them confuses everyone:
- You have not lost the name yet. The licence enters a hold period (next stage) during which you can still renew.
- It stops working. Registrars suspend expired domains: the website stops resolving and — the one that really hurts — email on the domain starts bouncing. For a trading business, this is the fire alarm. Perversely, it is also the most useful feature of the whole lifecycle, because for businesses that ignored every reminder, the outage is the first notice they actually receive.
Stage 3: The expired hold (grace) period
After expiry, the domain sits in an expired-hold state for around 30 calendar days. During this window:
- the registrant can renew at the normal renewal price (some registrars add a late or restoration fee, particularly late in the window — check your registrar’s terms);
- the domain generally remains suspended and non-functional;
- nobody else can register it.
This grace period is your safety net, and 30 days sounds generous. In practice it evaporates. The scenario that eats it: the outage is misdiagnosed. The business thinks the website is “down”, asks their hosting company, waits for a developer, restarts things — days pass before anyone checks the WHOIS and discovers the domain itself expired. If anything on your domain ever stops working, checking the expiry date in WHOIS should be diagnostic step one. It takes thirty seconds and it is the difference between a same-day fix and the next stage.
Stage 4: Purge and the drop list
If the hold period ends without renewal, the registry purges the domain — deletes it — and it becomes available for anyone eligible to register. Purged .au names are published in advance on a public daily drop list (also called the purge list), showing exactly which names are being deleted and when.
This transparency is deliberate and, on balance, healthy: it gives expiring names an orderly path back into use rather than leaving them to whoever happens to notice. But understand what it means for you: in the final days of your grace period, your domain is advertised to the entire domain industry as about to become available. If the name has any value — age, traffic, keywords, brandability — people are watching it.
Stage 5: The drop
At a set time each day, the listed names are released. For any name worth having, manual re-registration is hopeless: drop-catching services — specialist operators running automated, registry-connected systems — compete to register listed names in the instant they become available, typically on behalf of clients who have placed backorders, with contested names going to auction between interested buyers.
Within seconds of the drop, your former domain can have a new registrant. Legitimately. This is not hacking or theft — the licence lapsed, the name returned to the pool, and someone eligible registered it under the same rules you originally did. (One note for the other side of the trade: .au eligibility still applies, so a caught .com.au must be held by an entity with a qualifying Australian presence and connection — drop-catching does not suspend the licensing rules.)
After the drop: your options are bad
Once a domain has dropped and been caught, you are negotiating from weakness. Realistically:
Buy it back. The new holder may be a competitor who wanted it, an investor planning to develop it, or someone intending to offer it back to you. Either way, the price is now whatever the market — or your desperation — will bear, and a domain with a visible operating history behind it is priced accordingly.
Dispute it. The .au Dispute Resolution Policy (auDRP) exists for names registered in bad faith against someone with rights in the name — think trade mark holders. It is a genuine remedy in genuine abuse cases, but it is a formal proceeding with fees and no guarantee, and an expired name picked up on the open drop is frequently not bad faith. Treat it as a last resort, not a plan.
Move on. Sometimes the sane answer. Rebrand the email, redirect what you can, and absorb the lesson. It is a miserable answer for a trading business, which is why the next section is the one that matters.
In my case, we bought it back, at a multiple of what a decade of renewals would have cost, after two weeks of bounced email that we papered over with a hastily registered variant. The buyer was polite, professional, and entirely within the rules. The failure was ours.
Making sure this never happens to you
Everything above is avoidable with a handful of boring habits. In order of importance:
1. Fix the registrant contact email — today
The single highest-value action in this article. Check which email address your registrar holds for the registrant, right now, and make sure it is an address that is read by a current human and is not hosted on the domain itself (if the domain goes down, so do its mailboxes — exactly when you need the renewal notice). Add a second contact on a different domain if your registrar supports it.
2. Turn on auto-renew — and keep the card alive
Auto-renew fails silently when the stored card expires or the account email is dead, which is how businesses with auto-renew “on” still lose domains. Pair it with habit 3.
3. Keep a renewal calendar outside the registrar
A recurring entry in the business calendar, a month before expiry, for every domain you hold. If the registrar’s systems, emails, and card billing all fail, one human glancing at a calendar still catches it. Check the authoritative expiry date against WHOIS once a year — not your memory, and not an old invoice.
4. Register for multiple years
A five-year licence turns an annual single point of failure into a twice-a-decade event, for a cost difference that rounds to nothing against what the domain is worth to you.
5. Consolidate and audit
Scattered domains across registrars, old staff accounts, and resellers nobody remembers are how renewal notices get lost. One registrar account, owned by the business, with two-factor authentication and a documented recovery path — audited annually alongside the ABN details that keep you eligible in the first place.
6. If you ever see the warning signs, act same-day
Website down and email bouncing at the same time? Check WHOIS immediately. Inside the grace period, renewal is usually a ten-minute, same-day fix. Outside it, you are reading the second half of this article for real.
The lifecycle at a glance
| Stage | Roughly when | Domain works? | Can you save it? |
|---|---|---|---|
| Licence active | Up to expiry date | Yes | Renew any time (1–5 year terms) |
| Expired | Expiry day | Usually suspended — site and email down | Yes — renew at normal price (late fees possible) |
| Expired hold / grace | ~30 days after expiry | No | Yes — this is the safety net; act same-day |
| Listed for purge | Final days of hold | No | Renew immediately — the industry can now see it coming |
| Dropped | After purge | N/A — deleted | No — it is open to any eligible registrant, and drop-catchers are faster than you |
Timings are indicative of standard practice; your registrar’s documentation has the exact operational detail, and the authoritative expiry date for any domain is always the auDA WHOIS.
Monitoring: cheap insurance for names you care about
Beyond your own renewals, two kinds of watching are worth setting up:
Watch your own estate. If you hold more than a couple of domains, do an annual WHOIS sweep of all of them — expiry date, registrant entity, contact email — against a spreadsheet. Five minutes per domain, once a year, catches the drift (lapsed ABNs, departed staff contacts, that domain the old marketing agency registered) that causes silent expiries. Our registrar guide covers consolidating this into one account with proper alerting, which shrinks the sweep to one login.
Watch names you want. If there is a domain you would buy the moment it lapsed, you do not need to camp on the drop list yourself — backorder it with a drop-catching service and let their automation do the watching. Just go in with sober expectations: a name worth backordering is usually worth it to someone else too, and contested catches go to auction.
For buyers: the legitimate side of the drop
It would be incomplete to pretend the drop is only a horror story — it is also where domain investors and businesses acquire names legitimately. Expired .au names are monitored through the public drop lists, backordered through drop-catching services, and won at auction when contested. If you are on that side of the trade: check the name’s history before bidding, remember that eligibility and allocation rules apply to you as the new registrant, and understand that the previous holder’s story — the one this article is about — is sometimes still unfolding. Some of the best acquisitions come with a seller who simply made the mistakes above; some come with a dispute. Price accordingly.
The short version
A .au domain expires in slow motion: reminders, expiry, a ~30-day suspended grace period, the public drop list, then the drop itself — where automation takes it in seconds. Every stage before the drop is recoverable; nothing after it is cheap. The entire defence costs a few dollars and ten minutes a year: a live contact email off-domain, auto-renew with a working card, a calendar entry, and a multi-year licence.
The silence is what gets you. Make sure, somewhere in your business, something is listening.
Lifecycle stages and timeframes are set by auDA policy and registry practice and can change — verify current details at auda.org.au or with your registrar.