How to check a domain's expiration date (whois, RDAP, and bulk checks)

The fastest check: whois example.com | grep -i expir in any terminal, or paste the domain into the free domain expiry checker for the registry’s live answer with no install. Both take seconds. The rest of this post is the full toolkit - the whois one-liner and its traps, the RDAP query that gives you clean JSON instead of scrapeable text, a bulk script for a whole portfolio, and the reason spot-checking is the wrong long-term answer.

The whois one-liner

whois ships with most distributions (apt install whois / dnf install whois if not):

whois example.com | grep -iE 'expir|renewal'

Registry Expiry Date: 2027-08-13T04:00:00Z
Registrar Registration Expiration Date: 2027-08-13T04:00:00Z

Traps worth knowing before scripting against this:

• Every registry formats WHOIS differently. .com says Registry Expiry Date, .uk says Expiry date: with a dd-Mon-yyyy value, .de prints no expiry at all. A grep that works on one TLD silently matches nothing on another - and “no output” reads as “no problem”.
• Two dates can disagree. The registry’s date and the registrar’s date usually match, but during renewals and transfers they briefly diverge. The registry’s is authoritative.
• Rate limits are real. Registries throttle WHOIS aggressively; loop over a portfolio too fast and answers degrade into refusals mid-run.

RDAP: the structured answer

WHOIS is being replaced by RDAP (Registration Data Access Protocol) - the same registration data served as JSON over HTTPS from the registry itself, with standardised field names across TLDs. No install beyond curl and jq:

curl -s https://rdap.org/domain/example.com \
  | jq -r '.events[] | select(.eventAction == "expiration") | .eventDate'

2027-08-13T04:00:00Z

rdap.org is a public redirector that bootstraps to the right registry endpoint per TLD (the authoritative list lives at IANA). Alongside the expiry event you get registrar, nameservers, and the status array - where clientTransferProhibited is the healthy transfer-lock state, and redemptionPeriod or pendingDelete means the domain is already past expiry and deep into the expiry timeline.

This is exactly what the domain expiry checker runs under the hood - live RDAP, not a cached WHOIS mirror - if you want the same answer without a terminal.

Checking a whole portfolio at once

For more than a handful of domains, loop RDAP and sort by urgency:

#!/bin/bash
# expiry-report.sh - days remaining per domain, soonest first
DOMAINS="example.com example.org example.io shop-example.co.uk"

for d in $DOMAINS; do
  exp=$(curl -s "https://rdap.org/domain/$d" \
    | jq -r '.events[]? | select(.eventAction == "expiration") | .eventDate' | head -1)
  if [ -n "$exp" ]; then
    days=$(( ($(date -d "$exp" +%s) - $(date +%s)) / 86400 ))
    printf '%s\t%s\t%d days\n' "$d" "${exp%%T*}" "$days"
  else
    printf '%s\tNO EXPIRY DATA\n' "$d"
  fi
  sleep 1
done | sort -t$'\t' -k3 -n

shop-example.co.uk   2026-09-02   40 days
example.io           2027-01-15   175 days
example.com          2027-08-13   385 days
example.org          NO EXPIRY DATA

The NO EXPIRY DATA branch matters: a few ccTLD registries publish no expiry date over RDAP or WHOIS at all, and for those the registrar dashboard is the only source of truth. Treat missing data as a domain to check manually, never as a domain that is fine.

Why spot-checking is the wrong long-term answer

Every method above shares a failure mode: it answers “when does this expire?” on the day you remember to ask. Expiry disasters happen on the days nobody asks - auto-renew quietly failing on an expired card, reminder emails landing in a departed employee’s inbox, the one domain that never made it onto the list. Cron-ing the script above helps, until the cron host dies and “no report” looks identical to “nothing due”.

The durable version is a monitor that queries the registry on schedule and escalates as the date approaches: a free AlertKick domain monitor checks expiry via RDAP daily and alerts on a widening schedule before renewal day - Slack, email, Telegram, or a full on-call rotation, none of which depend on someone remembering to run a script. SSL certificate expiry rides along in the same monitor list, since a lapsed domain takes every certificate under it down too.

Domain monitors are on the free plan - add your domains in a couple of minutes and keep the one-liners for spot checks.