An expired .es is released in ten days. A .com can give you eighty

A .es domain that is not renewed is cancelled ten days after it expires and becomes available to anybody. After that there is no redemption period: the registry describes ten days to pay and, if it goes unpaid, cancellation. There is no later stretch in which to buy it back. A .com, in the same situation, can give you up to eighty days of room. And on 13 August Infoblox published how many people are waiting on the other side: around 65,000 expired domains are re-registered every day, nearly 20% of all the registrations they observe.

Two calendars with nothing in common

The ICANN policy governing generic domains —the Expired Registration Recovery Policy— requires your registrar to send two notices before expiry, one roughly a month ahead and one roughly a week ahead, and a third within five days after if it goes on to delete the domain. Then come three stretches:

The eighty days in the headline are our arithmetic —45 + 30 + 5— and they only appear if your registrar offers the full forty-five. It may offer one. The only stretch you can genuinely count on is the thirty of redemption, and you pay for that separately.

The ERRP also requires the registrar to disrupt the domain's DNS for up to eight days before deleting it, and the registry to do the same during the thirty days of redemption. The website and the mail go down on purpose, as a last notice that the domain has expired. When somebody calls saying "everything went down at once and we did not touch a thing", that is one of the causes to rule out before you start looking at servers.

And now .es, which is where we work

The .es is not governed by ICANN but by Red.es, and its calendar works differently. The registry's own website describes it in these terms: once the renewal date passes the domain is temporarily deactivated; from that moment there are five days to pay the renewal and another five to reconcile the payment; if it is not paid, ten days after expiry the domain is cancelled and becomes available. That is the end of it. To get it back, the official instruction is to go and check whether it is still free and register it again, like any stranger would.

The notices work differently too. If the domain is handled by a registrar agent —the Agente Registrador figure of the .es registry— and that agent has not requested renewal five days before expiry, the registry informs the administrative contact. If you hold it directly with Dominios.es, the notice goes out ten days before. Compare that with the month of warning the ERRP demands on a .com: here the first notice can land on the very August Tuesday the person receiving it starts their holidays.

Put the two rules together and the scenario follows on its own, with no need for it to have happened to anybody: the notice goes out five days ahead, to the administrative contact, and on registrations made years ago that contact is often a named person who is no longer there. Nobody reads it. The mailbox does not even have to bounce: it is enough that nobody opens it. It is the same hole we wrote about with the OneDrive of someone who left, swapping the file for a domain record.

Who is waiting on the other side

The research Infoblox published on 13 August puts numbers on a market that runs daily and quietly. During the first half of 2026 around 50,400 generic domains a day were caught and re-registered, and roughly 65,000 counting country-code ones: close to 20% of all registrations they observe. One in five names registered today already had a life before.

The second part of the work follows an actor they call Sable Squirrel. Infoblox attributes more than 10,000 domains under its control and confirms 430,000 dollars in auction purchases across around 160 of them —from which they extrapolate total spending "north of seven million". They buy on DropCatch, GoDaddy, Namecheap and Dynadot, and they buy, in the report's words, to inherit what those domains already have: aged registration history, real inbound traffic and backlinks from other sites.

Of the domains Infoblox could trace from purchase to first activity, 24% were live the same day they were caught; three out of four within a week; 94% within two weeks. And on that infrastructure they counted more than 31,000 malware samples calling home to command servers hosted on those domains —Quasar, AsyncRAT, DCRat, NanoCore, Remcos, njRAT— with 405 domains configured for it.

The report never says this actor goes after Spanish SMEs: its business is sports piracy and gambling, and the malware rides on top of that infrastructure. Nor are the 65,000 a day abandoned corporate domains; they are dropped domains of every kind. What is demonstrated is that the market exists, pays for age and reputation and moves in hours. If yours falls into it, you will not get an afternoon to think about it.

What still points at that name once it is not yours

What gets lost is not the old website, which usually matters to nobody. It is everything still sending data to that name, and the list tends to be longer than it looks:

None of those four points is a prediction that it will happen to you. They explain why the market pays: it pays for the habit of everybody who still writes to that name.

When there is nothing to renew

Renewing everything forever just in case is not something we sign. There are portfolios with twenty defensive domains bought in 2011 that have not had a visit or sent an email since; there the annual invoice is the only real risk. A domain that was never anybody's MX, appears on no printed paper and has nothing linking to it can be dropped with no consequences.

Dropping it properly has homework: pull the MX records a few months ahead and check in the mail server logs that nothing is still arriving, search for the name in code and documentation, and tell whoever has it written down. Losing it consists of doing none of that homework and hearing about it from a customer.

How we have it set up

We keep the network documented in NetBox as the source of truth and monitoring in Zabbix, and the criterion we apply there applies here too: a domain is treated as an asset, not an invoice. An expiry date is a state you can query and therefore a state you can alert on, the same way you alert on a certificate or a disk. The registrar's email arrives late and at a single address. It is the same logic as the DNS nobody counts as a service until it falls over.

Translated into what you can check this afternoon, without calling anybody:

The part that does not flatter us, said in full: we make a living running other people's infrastructure, so an article ending in "this needs watching" suits us. Read it with that in mind. What our interest does not change is the registry's deadline: ten days, and after that the name is out of your hands. Getting it back becomes a dispute procedure, not a renewal.

Sources (consulted on 15 August 2026): the volume of caught domains —around 50,400 generic per day, roughly 65,000 including country-code ones, close to 20% of observed registrations in the first half of 2026— "Drop Something? Don't Worry, Someone Caught It" by Infoblox Threat Intel, published 13 August 2026; the Sable Squirrel figures —more than 10,000 domains, 430,000 dollars confirmed across around 160, extrapolation north of seven million, 24% live the same day, 94% within two weeks, more than 31,000 malware samples and 405 command domains— part two of the same research; mandatory notices, auto-renew grace of 1 to 45 days, 30-day redemption and DNS disruption up to 8 days before deletion — ICANN's Expired Registration Recovery Policy; the 5-day pending delete stage is not set by the ERRP but by the standard generic-domain registry lifecycle (RFC 3915); the .es timings —temporary deactivation, 5 days to pay and 5 to reconcile, cancellation and availability at 10 days, notice 5 or 10 days ahead and renewal only by the administrative or billing contact— the renewal page and FAQs of the Dominios.es registry (Red.es). The 80-day total is our own arithmetic and depends on the registrar offering the full 45. Photo: "Uneeda Biscuit ghost sign", public domain (CC0), via Wikimedia Commons.