Domain expiry tracking

A certificate and a domain registration are two different clocks. Tidehawk watches both. This page covers the registration.

Where the date comes from

For each tracked domain, Tidehawk works out the registrable domain, then asks the registry directly.

It queries RDAP first. The right registry server for the top-level domain is found from the IANA bootstrap list, which Tidehawk caches for a day. From the response it reads three things: the registrar, the registration date, and the expiry date.

For top-level domains that publish no RDAP service, Tidehawk falls back to WHOIS and reads the same three fields from whichever field names that registry uses.

Both lookups are read-only. Tidehawk never sends anything to a registrar on your behalf.

What you will see

On the client’s Domains tab, and on the Domains page in the sidebar, each row carries the registrar, the registration date, the expiry date, the days remaining and a status pill. Where a registrar publishes an IANA tag it appears next to the name.

The status tiers are the same ones used for certificates, in certificate status, with one extra case. A domain whose expiry date has not come back yet shows a dash and counts as Not tracked rather than healthy. That happens where a registry answers neither RDAP nor WHOIS with a usable date, and it is honest about not knowing rather than implying a clean bill of health.

The Domains page also offers filters for Expiring ≤7d, Expiring ≤30d, No certs and Needs attention, and a search across hostname, client and registrar.

How often it is re-read

Registry data changes rarely and registry endpoints are rate-limited, so a domain’s expiry is refreshed at most once a day. A sweep every six hours picks up whichever domains have gone stale, oldest attempt first.

Tidehawk does not renew domains

This is the important point. Tidehawk tells you a registration is running out. Renewing it is your job, at the registrar, exactly as it is today.

What happens after an alert

Tidehawk keeps re-reading the registry after the alert fires, and reacts to what it finds.

If the domain was renewed, the registry returns a later expiry date. Tidehawk stores the new date, then resolves the open alerts that the old date had raised and no longer apply. Where one of those alerts opened a PSA ticket, Tidehawk closes that ticket too, so a technician is not left chasing a domain that was renewed weeks ago. The domain can alert again later against the new date.

If the domain was not renewed, nothing moves. Once the date passes, the row turns red and reads Expired, with the days remaining shown as a negative number. That state stays until the registry says otherwise.

Turning it off for a domain

Registry expiry tracking is on for a domain by default. Where it is switched off, the six-hourly sweep skips that domain’s registry lookup, and its certificate scanning is unaffected.