google.com

com when does the registration expire which entity holds the technical lock and where does the chain of DNS authority begin? We identify the registrar — the accredited company that holds the registration contract with the TLD registry. The original registration date establishes the domain's age which is factored into spam heuristics and email deliverability scoring.

The expiry date is the single most operationally critical field in this record — a lapsed registration is the most common non-adversarial cause of complete domain loss. The delegated nameservers tell you which DNS provider holds the zone — a mismatch between what's here and what you expect can indicate a stale delegation.

We also surface the DNSSEC delegation state which tells you whether the registrar has published DS records to the TLD registry creating a cryptographic chain of trust down to the zone.

Domain hijackings are overwhelmingly initiated at the registrar level not the DNS level — an attacker who can access the registrar account can change the nameservers and redirect all traffic within minutes before anyone monitoring DNS changes can react. Two registrar-side controls dramatically reduce this risk.

com does not appear to have clientTransferProhibited set — enabling this at the registrar immediately reduces the risk of an unauthorised domain transfer. DNSSEC provides a cryptographic chain of trust from the TLD registry DS record down to individual DNS answers: enabling DNSSEC at the registrar prevents forged DNS answers even if the nameserver is compromised.

The registration age in the WHOIS record also matters for email deliverability independently of technical authentication.

Spam filters and mailbox provider heuristics treat domain age as a trust signal: newly registered domains — domains registered within the last 30–90 days face elevated scrutiny from Gmail Outlook and Yahoo who weight the WHOIS creation date alongside SPF DKIM and DMARC posture when making inbox placement decisions.

A domain with perfect email authentication but a two-week registration history will still land in spam for bulk senders because the age signal overrides the authentication signal in the first months of a domain's life.

A healthy WHOIS posture combines renewal security access control and cryptographic integrity. On the renewal side: more than 90 days until expiry with auto-renew enabled and a second valid payment method on the registrar account.

A single declined credit card charge during the renewal window is enough to drop a domain into the five-day grace period then into the redemption period (where recovery typically costs hundreds of dollars) and eventually into pending-delete status where the domain is released to the public and can be registered by anyone including typo-squatters or phishing operators.

Registering the apex for two to ten years out (rather than on an annual rolling basis) eliminates this failure mode almost entirely.

On the access control side: clientTransferProhibited should always be set; clientUpdateProhibited (which prevents registrant data changes without an explicit unlock) is the next layer; and for business-critical domains registry lock — a premium add-on that elevates the transfer block to the registry itself and requires a manual out-of-band process to release — would have prevented most of the high-profile domain hijackings of the last decade.

Use Run live again 90 and 30 days before the renewal date to get an unambiguous current reading directly from the authoritative registry — registrar-side dashboards sometimes lag the actual registry state.

Domain loss follows a predictable pattern in almost every case we've seen: an auto-renew fails silently because the payment method on file expired or was cancelled no one monitors the WHOIS expiry date and by the time the domain stops resolving the five-day grace period is already closing. com eliminates every point of silent failure in that chain.

First enable auto-renew at the registrar and add a second valid payment method — not as a backup to the primary card but as an independent billing source (a different card or a prepaid credits balance) so a single card cancellation never blocks a renewal.

Second extend the registration as far out as the registrar allows — two to ten years is typical — so a lapsed payment method can never coincide with an expiry date. Third set clientTransferProhibited and clientUpdateProhibited in the registrar dashboard; unlock only for the duration of a legitimate transfer or registrant data change then re-lock immediately.

Fourth for any domain that is genuinely business-critical — one whose loss would cause immediate revenue impact or reputation damage — purchase registry lock from the registrar; this moves the unlock authority up to the TLD registry itself and requires an operator-assisted identity-verified out-of-band process to release making it essentially immune to account compromise.

Fifth protect the registrar account with a hardware security key (FIDO2) rather than SMS-based two-factor authentication; SIM-swap attacks are the most common first step in targeted domain hijacking campaigns. Finally set two calendar reminders — at 90 days and 30 days before the renewal date — and re-run this WHOIS report on each occasion.

The WHOIS record and the TLD registry are the one piece of your infrastructure that fails closed and silently from the outside so an external check against the authoritative registry is worth more here than a dashboard login to the registrar's own interface.