--- title: "Expired .pt domain and SSL | DataRoad IT" description: "A lapsed .pt domain takes your website and email offline the same day, and SSL drops to 47 days in 2029. Managed inventory and alerts. No obligation." language: en url: https://www.dataroad-it.com/en/domains-dns-ssl-certificates-expiry/ source: https://www.dataroad-it.com/en/domains-dns-ssl-certificates-expiry/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > A lapsed .pt domain takes your website and email offline the same day, and SSL drops to 47 days in 2029. Managed inventory and alerts. No obligation. # Expired .pt domain and SSL: website and email offline in a day At a glance For decision-makers short on time. - 01 Unrenewed .pt domain: website and email go down the day the term ends. - 02 You have 30 days to recover it, at extra cost; then the name is open to others. - 03 SSL certificates: 200 days from March 2026, 47 days from 2029. - 04 DataRoad puts domains, DNS and SSL under monitoring, with alerts at 30 and 7 days. ### In this article Picture a Monday with no email. Proposals that never arrive, invoices bounced back, the website showing a red warning in the browser. No hacker, no hardware fault: just an **expired .pt domain** or an SSL certificate past its validity. It is one of the cheapest IT failures to prevent and one of the most expensive to suffer. Three rules prevent it: the domain is in the company's name, a named person is responsible for renewals, and alerts fire weeks before each date. ## What does an expired domain cost a company? It costs the whole day, from the first hour. When the paid term ends, the .pt stops responding on the internet. Website and mailboxes go down together, and whatever clients and suppliers send in that window may simply be lost. The .PT rules give a second chance, but it costs money and the domain stays inactive: - **Up to the last paid day**: renew at the normal price. - **In the following 30 days**: you can still recover the name, at an extra cost; throughout this period the domain is inactive. - **On day 31**: the name is deleted and anyone can register it. There is no phase in which everything keeps working while you decide. And the last step is the worst: a third party holding your name can set up fake emails in your company's name. We show how that scam works in the article on [altered invoices and email fraud](https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/). ## Do you know, today, whose name your domain is in? Most boards do not. Under the rules of Associação DNS.PT, the body that manages the .pt extension, whoever is listed as registrant has exclusive, renewable use of the name. Only that person or entity decides to renew, change or transfer it. In the audits we carry out, names turn up registered to people no longer at the company: - **Someone who left** Handled the website "some year or other" and the registration stayed with them. - **The agency behind the first website** Registered it in its own name and never transferred ownership. - **The previous IT provider** Kept the access when the contract ended. The result: the brand runs on a name the company does not control. A renewal notice sent to a mailbox nobody opens is enough to switch it off. .PT also separates three roles. The **registrant** is the owner. The **managing entity**, usually a registrar, maintains the registration. The **technical contact** administers the DNS zone. The last two can be external partners; the first must always be the company. Changing IT partner? Check this before signing, as we explain in the guide to [switching IT partner without losing control](https://www.dataroad-it.com/en/switch-it-provider-portugal/). ## Why is renewing certificates by hand no longer an option? Because in 2029 each certificate will have to be replaced around eight times a year. The SSL certificate is the padlock in the browser: it confirms the site is yours and encrypts the traffic. Its maximum validity is set by the CA/Browser Forum, which brings together certificate authorities and browser makers. In April 2025, the forum approved this schedule of reductions: | Takes effect | Maximum duration | Replacements per year, approx. | | --- | --- | --- | | 15/03/2026 | 200 days | 2 | | 15/03/2027 | 100 days | 4 | | 15/03/2029 | 47 days | 8 | At this pace, only automatic renewal is viable. And automation also fails silently, so someone has to watch over it. One more warning: since 4 June 2025, Let's Encrypt, one of the most popular no-cost certificate authorities, no longer sends expiry reminder emails. Anyone who relied on them lost their last safety net. ## How can a DNS change silence all your email? One wrong record is enough. Think of DNS as the directory that tells the internet where the website lives and where mail should go. **MX** records point to the mail server. **SPF, DKIM and DMARC** vouch to other servers that your messages are legitimate, cutting out spoofing and spam-folder deliveries. Whether on [managed Microsoft 365](https://www.dataroad-it.com/en/microsoft-365-management/) or another platform, mail depends on these records. A careless move of the website's hosting can divert or block every message, and nobody notices straight away. The rule: whoever changes DNS must know the full configuration and document every change. The most common mistakes are in [what fails in Microsoft 365 email security](https://www.dataroad-it.com/en/microsoft-365-email-fraud-managed-security/). ## Which controls should you demand from your IT partner? Seven. If your provider does not give you this in writing, the risk is still yours: - **Domain map** All of them, including brands and old names, with registrant, registrar and expiry date. - **Verified registrant** The company, with a corporate mailbox as the contact, never a personal one. - **Auto-renewal** Switched on, with a payment method that does not expire. - **Certificate map** Validity and renewal method for each one. - **DNS copy** MX, SPF, DKIM, DMARC and every other record, documented. - **Two alerts per deadline** At 30 and 7 days, to more than one person. - **Continuous testing** The site responds and the certificate is valid. ## How does DataRoad eliminate this risk for the clients it manages? We treat a domain as we treat a critical server. Every name and every certificate goes into the [NOC and alert monitoring](https://www.dataroad-it.com/en/noc-it-monitoring-portugal/): there is an alarm before the deadline and a designated engineer to act. This monitoring is included in all IT Unlimited plans. Those who choose the [IT Unlimited Premium plan](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/) also get unlimited on-site support. **Proof in the field.** In 2019, PTR Pharma Consulting entrusted DataRoad with hosting its corporate website and email, within an annual IT Unlimited contract that covers the rest of its infrastructure. [See how we manage PTR Pharma](https://www.dataroad-it.com/en/ptr-pharma-consulting-managed-it-hosting/). At Boost Portugal, website hosting and domain registration sit with a single partner, alongside remote monitoring and availability reports. [Read the Boost Portugal case](https://www.dataroad-it.com/en/boost-portugal-redundant-internet-managed-it/). One owner, one inventory, zero missed dates. ## Questions from decision-makers ### Where can I confirm the registrant of the company's .pt domain? In the WHOIS search on the .PT website. For companies, the registrant's name and address are public information. If your company does not appear, request a transfer of ownership straight away. ### I renewed the day after the deadline. Will I get my website and email back? Yes, for a .pt you can recover it, if you renew within the extra 30 days and pay the additional fee. The name becomes active again. Outside that window, the domain has already been deleted. ### Why are SSL certificates getting shorter? To limit the time a stolen certificate can be used, as decided by the CA/Browser Forum. In practice, renewal has to be automated and supervised. ### Can an expired SSL certificate also take down email? It can, depending on the platform. On the website, a "connection not secure" warning appears; on an in-house mail server, email may fail. On Microsoft 365, Microsoft manages the certificates, but the domain and DNS always remain on the company's side. ## Want to know in 5 working days where you are exposed? We map domains, certificates and DNS, confirm registrants and dates and leave the alarms active. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** +351 211 459 950 * · sales@dataroad.pt **Call to a Portuguese landline.* ## Sources - Associação DNS.PT.pt domain registration rules: [pt.pt](https://www.pt.pt/fotos/editor2/pt_regras_registo_2026.pdf) - CA/Browser Forum: Ballot SC-081v3, approved on 11 April 2025: [cabforum.org](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) - DNSimple: SSL validity dates from 2026 to 2029: [support.dnsimple.com](https://support.dnsimple.com/articles/announcement-ssl-certificate-validity-changes/) - Let's Encrypt: end of expiry notifications: [letsencrypt.org](https://letsencrypt.org/2025/06/26/expiration-notification-service-has-ended/) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Cloud and Microsoft 365 ## One StepAhead of IT. The right licences, MFA on every account and backups that actually restore. The cloud stops being an invoice and becomes a tool. - **0** DataRoad security incidents in 11 years - **232** clients under management - **Failover** redundant internet and power autonomy We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/domains-dns-ssl-certificates-expiry/