/guides · /guides/fake-domain-renewal-notices
Domain renewal notices that are not from your registrar
For a generic ending, your registrar and your expiry date are both in the public record — so a notice that disagrees with them is a sales letter rather than a bill.
Why you are on the list
Domain registration data is public. The registrar, the creation date and the expiry date are all published, and anyone can query them in bulk. Redaction since 2018 removed the registrant name and address from that record, but not the dates — so a company that cannot learn who you are can still learn exactly when your domain expires.
That is enough to build a mailing list. The notices arrive a few weeks before expiry, because that is when the data says you will be thinking about it.
What these notices actually are
Most are not fraud in the legal sense, which is why they have survived for twenty years. They are offers, formatted to look like invoices. The best-known arrive as physical letters on official-looking paper, with a reference number, an amount and a due date, and somewhere in the small print a sentence saying this is a solicitation and not a bill.
Paying one does something: it transfers your domain to that company at several times the going rate, and often for a longer term than you wanted. You have not been robbed. You have bought something you did not intend to buy, from a company you had not heard of, and getting back out means a transfer you will have to initiate yourself.
A second format turns up by email, usually claiming that somebody in another country is about to register your brand name under endings you do not own, and offering to protect it. This one says nothing about your registration at all, so the lookup below cannot refute it — and it does not need to. There is no such applicant. The message is a cold sales approach dressed as an emergency, sent to every address its author could find, and the deadline in it is the only urgent thing about it.
The check that ends it
The invoice-shaped ones all make a claim about your registration, which means all of them are checkable. Run a WHOIS / RDAP lookup on your own domain and compare two fields against the notice: the registrar of record, and the expiry date.
Two fields, one lookup, no judgement call required. A real renewal notice will agree with the public record, because it is drawn from the same registration.
Two things to know before you run it. If you bought through a reseller, the registrar named in WHOIS is the accredited company behind it rather than the shop you dealt with, so an unfamiliar name there is normal — check it once, while nothing is wrong, so you recognise it later. And some country-code registries publish less: .de, for one, returns no expiry date and no registrar at all, which means this comparison is not available and the only reliable check is your own account.
Even when it matches
A notice that passes the test still deserves the same habit as any other message about money: do not use its link. Go to your registrar by typing the address yourself and renew from inside the account. That removes the entire category of look-alike sites from the equation, and it costs you nothing.
It is also worth knowing how your own registrar behaves, so an unusual message stands out. We write 30, 14 and 3 days before expiry, nothing renews by itself, and no card is stored — the reasoning is in how renewals and expiry work. A shop that never auto-charges cannot send you a surprise invoice, which makes any surprise invoice easy to classify.
If one of these has already been paid, the domain has usually been transferred rather than lost. Contact the company, ask for the transfer to be reversed or for the authorisation code, and transfer it back to a registrar you chose. It is slow and it is recoverable, which is more than it feels like at the time.