Domain and certificates expiring: the error that brings down the website and the email

8 min read · DataRoad

Domains and certificates that are about to expire These are the most preventable mistakes — and the most serious ones. There is no attack, no failure: there is just a date that went by without anyone noticing it. The next day, the website shows a “unsecured connection” warning or simply disappears, and the emails stop arriving. The direct answer: ensure that the company owns the domain, that someone is responsible for renewals, and that there are automatic alerts weeks before each deadline.

What's at stake: three pieces that support the website and the email

The three pieces have different deadlines and, often, different suppliers — and too often, no one is responsible for them.

Who is the owner of your domain?

This is the first and most forgotten question. According to the .PT registration rules (the DNS.PT Association, which manages the .pt domains), the holder acquires an exclusive and renewable right of use over the name. It is the holder who decides on the domain — renews it, transfers it, changes it.

In practice, we often encounter domains registered in the names of:

• an old collaborator who handled the site “for a few years”;
• the agency that created the first website;
• the former computer provider, who got the credentials when the contract ended.

In all these cases, the company uses a name it does not control. All it takes is a renewal notice sent to an abandoned mailbox.

The rules of .PT also distinguish the holder of the Managing entity — usually a registrar, which deals with the registration and maintenance of the domain — and Technical contact, The DNS zone is managed by them. They can be different partners, but the owner must always be the company. If you are switching IT providers, please confirm this first: it is one of the points in our guide change IT company.

What happens when a .pt domain is not renewed

The registration rules for .PT are clear:

1. The renewal is made until the end of the paid term.
2. After the deadline, there is an additional 30-day period for renewal. But during this period, the domain no longer remains active on the internet: the website and email stop working.
3. Renewing that additional period has an additional cost.
4. If it is not renewed within these 30 days, the domain is removed and becomes available for registration by anyone.

Point 2 is what catches companies by surprise. There is no “free period” where everything continues to work. The impact is immediate — and the emails sent by customers and suppliers during that time may not reach their intended recipients.

Point 4 is the worst-case scenario: the company name could be registered by third parties, including those who want to use it to send fraudulent emails on behalf of the company. For more information about this risk, read our article on Email fraud and altered invoices.

SSL certificates: deadlines becoming increasingly short

The certificates that give the padlock to the site have a limited validity, defined by the CA/Browser Forum — the body that brings together the certification entities and the manufacturers of browsers. In April 2025, a progressive reduction was approved:

FromMaximum validity of a certificateRenewals per year (approx.)

The consequence is simple: with eight renewals per year per certificate, manual renewal becomes no longer feasible. It has to be automatic — and someone has to verify that the automation continues to work.

There is another warning sign. Let’s Encrypt, one of the most used free certification entities, has stopped sending expiration warning emails on June 4, 2025. Those who relied on these emails to remember to renew have lost their safety net.

DNS and email: the detail that brings down the email box

The company's email — whether in Microsoft 365 or another service — it depends on correct DNS records. The MX records tell where the mail goes. Other records (SPF, DKIM and DMARC) prove to the other servers that the emails are actually from them and reduce the chance of them ending up in spam or being forged.

A poorly made change in the DNS — for example, when changing the hosting of a website — can spoof or block all email without anyone noticing immediately. Therefore, changes to the DNS must be made by someone who knows the entire configuration and has documented it. We explain what usually fails in email protection in Email security in Microsoft 365.

The solution: a single inventory and automatic alerts

Checklist for the direction

• List of all the company's domains (including the old ones and those of brands), with the owner, registrar and expiration date.
• The holder is confirmed in the name of the company, with the contact email from a company mailbox — never personal.
• Automatic renewal is active and a valid payment method.
• List of SSL certificates, with expiration date and renewal method.
• Documented copy of the DNS configuration (MX, SPF, DKIM, DMARC and other records).
• Automatic alerts 30 and 7 days before each deadline, sent to more than one person.
• Regular verification that the website is responsive and that the certificate is valid.

The rule we apply is to treat domains and certificates like any other server: they are included in the alarm monitoring, There is a warning before the deadline and a technician responsible for taking action. Alarm monitoring is included in all IT Unlimited plans — and in IT Unlimited Premium joins the on-site assistance.

A real case: website and email delivered to a single partner

In 2019, PTR Pharma Consulting chose to host its corporate website and email system on DataRoad's servers, under an annual IT Unlimited contract that also covers the remaining infrastructure. Read the PTR Pharma case.

Na Boost Portugal, The contract includes hosting of websites and domain registration, managed centrally by a single partner, along with remote monitoring and availability reporting. This is the goal: a single point of responsibility, a single inventory, no deadlines to forget about.

Frequently Asked Questions

How do I know who owns the domain of my company?

For .pt domains, you can consult the WHOIS search on the .PT website. In the case of legal entities, the name and address of the holder are public. If the holder is not the company, arrange for the transfer of ownership as soon as possible.

The domain expired yesterday. Will the website and email renew again today?

In a .pt domain, yes, as long as the renewal takes place within the additional 30 days provided for in the .PT rules, with the additional cost. After renewal, the domain becomes active again. After the 30 days have passed, the domain is removed.

Why have SSL certificates become shorter-lived?

By decision of the CA/Browser Forum, which brings together certification bodies and browser manufacturers. Shorter certificates reduce the time a compromised certificate can be abused. For companies, this means that renewal must be automatic.

If the certificate expires, will the email also stop working?

It depends on the service. In the case of the website, visitors see a warning about an unsafe connection. Email services hosted by the company itself can also fail. In Microsoft 365, certificates are managed by Microsoft — but the domain and DNS remain the responsibility of the company.

Inventory of domains and certificates in 5 working days

We raise all your domains, certificates and DNS records, confirm holders and deadlines, and leave the alerts configured. For companies with more than 10 locations · contract of assistance · remote, local and telephone support.

Sources

• .PT (DNS Association.PT) — Rules for registering .pt domain names: pt.pt
• CA/Browser Forum — Ballot SC-081v3, reduction of the validity of certificates (April 11, 2025): cabforum.org
• DNSimple — certificate expiration calendar 2026–2029: support.dnsimple.com
• Let’s Encrypt — end of the expired email service: letsencrypt.org