# Domain renewal scam emails: how to spot fake expiry notices

URL: https://iblockspam.com/blog/domain-renewal-scam-emails
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How to spot fake domain renewal and expiry emails, .cn brand registration scares, search engine invoices and slamming, and how to check your real expiry date.

## Short answer

A domain renewal scam email warns that your domain is expiring, or that someone wants to register your name in another country, and pushes you to pay a company that isn't your registrar. Look up your domain with ICANN's RDAP lookup to see your real registrar and expiry date, and renew only inside your registrar account.

A domain renewal scam works because losing your domain is frightening: your website goes dark and your email stops. The email doesn't need to hack anything. It just needs someone in the business to believe it and pay. This guide covers the main versions and shows you how to check your real registrar and expiry date in a minute, so the next notice is easy to judge.

For the wider family of bills for things you never ordered, see [fake invoice and payment emails](https://iblockspam.com/blog/fake-invoice-and-payment-emails).

## What types of domain scam emails are there?

| Type | What the email says | What's really happening |
|---|---|---|
| Fake registrar renewal | "Your domain expires in 3 days. Renew now." | Phishing for your card or registrar login |
| Fake "ICANN" notice | "ICANN: action required to keep your domain" | Phishing; ICANN doesn't bill registrants |
| Slamming / transfer notice | Looks like a renewal bill from "Domain Registry" or similar | Paying it can authorize a transfer to a different registrar |
| Asian domain "brand conflict" | "A company has applied to register yourname.cn" | A sales pitch for overpriced domains |
| Search engine submission invoice | "Annual search engine listing for yourdomain.com" | Payment for something search engines give free |

### Fake registrar renewal emails

These copy the look of a real registrar's reminder. The link leads to a fake payment page or a fake sign-in page for your registrar account. A stolen registrar login is far worse than a stolen card number. Whoever controls your registrar account controls your DNS, including your [MX records](https://iblockspam.com/blog/what-is-an-mx-record), so they can redirect your email or website. ICANN notes that unauthorized domain transfers can result from "unauthorized access to your email account or other login credentials" ([ICANN](https://www.icann.org/resources/pages/lost-domain-names)).

### Fake ICANN emails

ICANN, which coordinates the domain name system, has warned about renewal emails that "appear to be sent by ICANN." Its answer is short: "ICANN does not process domain registrations or collect fees from registrants directly" ([ICANN](https://www.icann.org/en/blogs/details/be-careful-what-you-click-alert-of-new-fraudulent-domain-renewal-emails-29-9-2014-en)). That alert asked people to report these scams to Contractual Compliance at compliance@icann.org, and to contact their own registrar about the status of a domain.

### Domain slamming

Slamming is the practice of tricking you into switching registrars with a notice that looks like a renewal. The best-known US case is from 2003. The FTC said Domain Registry of America mailed notices that "appear to be renewal notices or invoices from the consumers' current registrars," including "millions of such 'renewal' notices captioned 'IMPORTANT NOTICE'" ([FTC](https://www.ftc.gov/news-events/news/press-releases/2003/12/court-bars-canadian-company-misleading-consumers-marketing-internet-domain-name-services)). A stipulated court order barred similar conduct and said the company might have to provide redress to up to 50,000 consumers. The order was for settlement purposes and wasn't an admission of a violation.

Versions of these notices still arrive by post and email. The tell is the same: the sender isn't your registrar, and paying usually authorizes a transfer, not a renewal.

### Asian domain "brand conflict" emails

This one often arrives addressed to the CEO. A "registration center" in Asia says another company has applied to register your brand as an "internet keyword" and as domains such as `yourname.cn` or `yourname.com.cn`. It asks whether that company is your partner, and often says you only have a few days to respond.

It's designed to make you reply. Once you do, you'll be offered your own bundle of domains, for several years, at a high price. We couldn't find an official advisory on this specific scheme, so treat this as a description of a common pattern, not a ruling on any one email. The safe response is the same either way: don't reply. If you really want a Chinese domain or trademark protection, ask your own registrar or IP adviser.

### Search engine submission and SEO invoices

These look like an annual bill for "search engine registration" or "listing" for your domain. Google is clear: "Google never accepts money to include or rank sites in our search results," and "it costs nothing to appear in our organic search results." Google also advises you to "be wary of SEO firms and web consultants or agencies that email you out of the blue" ([Google Search Central](https://developers.google.com/search/docs/fundamentals/do-i-need-seo)).

The FTC's [small business scams guide](https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business-0) describes the same playbook: "phony invoices that look like you ordered products or services," and threats that "your business will lose its website URL if you don't pay immediately."

## How do you check your real registrar and expiry date?

Since 28 January 2025, ICANN says RDAP (Registration Data Access Protocol) is "the definitive source" for registration data in generic top-level domains such as `.com`, `.net` and `.org`, replacing WHOIS ([ICANN](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en)). You don't need any special tools.

1. Go to [lookup.icann.org](https://lookup.icann.org/en) and enter your domain.
2. Note the registrar. That's the only company that can renew your domain directly. (A reseller, such as your web host, may sit in front of it; check your invoices.)
3. Note the expiration date. A notice claiming your domain expires next week, when RDAP says 2028, is fake.
4. Look at the domain status codes. `clientTransferProhibited` means a transfer lock is on.
5. Compare the email's sender, date and payment link with what you found. Anything that doesn't match gets ignored.

If you prefer the command line, RDAP returns JSON. For a `.com` domain, Verisign's RDAP server answers directly:

```
curl -s https://rdap.verisign.com/com/v1/domain/example.com
```

In the response, the `events` list includes an `expiration` entry, as defined in [RFC 9083](https://www.rfc-editor.org/rfc/rfc9083.html), and the `status` list shows locks such as `client transfer prohibited`.

Country-code domains such as `.cn`, `.uk` or `.de` are run by their own registries. The ICANN lookup may not have their data, so check with that registry or your registrar.

### What genuine reminders look like

For generic top-level domains, ICANN's [Expired Registration Recovery Policy](https://www.icann.org/en/contracted-parties/consensus-policies/expired-registration-recovery-policy/expired-registration-recovery-policy-21-02-2024-en) requires registrars to send at least two notices before a registration expires: "approximately one month prior to expiration" and "approximately one week prior to expiration." If the domain isn't renewed or deleted, another notice must follow within five days after expiry.

So a real reminder comes from your registrar, on a schedule, about a date that matches RDAP. It doesn't come out of the blue from a company you've never heard of.

## How do you protect your domain from these scams?

Most of this is one-off housekeeping.

1. **Know your registrar.** Write down which company holds each domain, who has the login and when each one expires.
2. **Turn on auto-renew** and keep the payment card up to date. Then a renewal notice is never urgent.
3. **Protect the registrar account** with MFA and a unique password. Use a shared admin address that outlives any one employee, not a personal mailbox.
4. **Keep the transfer lock on.** ICANN says `clientTransferProhibited` "tells your domain's registry to reject requests to transfer the domain," which helps prevent "unauthorized transfers resulting from hijacking and/or fraud" ([ICANN](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en)).
5. **Route all domain and website bills to one person.** Accounts payable should never pay a domain, hosting or "listing" invoice that person hasn't approved.
6. **Watch for DNS changes.** If someone does get into your registrar account, the first sign is often a changed MX or SPF record. Check yours with the [MX Lookup](https://iblockspam.com/tools/mx-lookup) and the [Email Health Check](https://iblockspam.com/tools/email-health-check).
7. **Protect domains you don't send from.** Parked domains can still be spoofed; see [protecting parked domains from spoofing](https://iblockspam.com/blog/protect-parked-domains-from-spoofing).

### What to tell finance and the front desk

- Our domains renew automatically with [registrar name]. Any other company asking for domain payment is not our registrar.
- We never pay for "search engine submission", "internet keywords" or directory listings from an unsolicited email or letter.
- Emails about our brand being registered abroad go to [named person], unanswered.
- Never sign in to the registrar from a link in an email. Use the bookmark.

## What should you do if you already paid or clicked?

- **Paid by card:** call your card issuer, explain it was a deceptive charge, and ask about a chargeback.
- **Typed a registrar password:** sign in to the real registrar site straight away, change the password, turn on MFA, check the contact email and look for DNS or transfer changes. Our guide to [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) has the full checklist.
- **The domain was transferred without permission:** ICANN says to contact your previous registrar immediately and ask it to review the unauthorized transfer. Registrars decide case by case, and ICANN says it "cannot directly instruct them" to reverse a transfer ([ICANN](https://www.icann.org/resources/pages/lost-domain-names)).
- **Report it:** forward fake ICANN emails to compliance@icann.org, report fraud to the FTC at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/), and use your mail app's report button. See [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email).

## Next steps

- Look up every domain you own at lookup.icann.org today and record the registrar and expiry date.
- Check that auto-renew, MFA and the transfer lock are on for each one.
- Share the four-line rule above with finance and reception.
- Keep an eye on your DNS: iBlockSpam's [domain monitoring](https://iblockspam.com/features/domain-monitoring) alerts you when your MX, SPF or DMARC records change, weekly on Protect and daily on Protect Plus.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How do I know if a domain renewal email is real?

Look up your domain at lookup.icann.org. It shows your actual registrar and expiry date. A genuine renewal notice comes from that registrar, and the expiry date matches. If the email names a different company, a date that doesn't match, or a payment link outside your registrar account, treat it as a scam. Renew by signing in to your registrar directly.

### Does ICANN send domain renewal notices?

No. ICANN says it does not process domain registrations or collect fees from registrants directly. Fees are paid between you and your registrar. ICANN has warned about phishing emails made to look as if they came from ICANN, and asks people to report them to its Contractual Compliance team at compliance@icann.org.

### Someone wants to register my company name as a .cn domain. Is it a scam?

Usually it's a sales pitch dressed as a warning. The email says another company has applied for your name in China and asks whether they're your partner. Replying usually leads to a quote for a bundle of domains. If you genuinely need a Chinese domain or trademark, buy it through your own registrar or adviser, not the sender.

### What is domain slamming?

Domain slamming is a misleading notice designed to get you to transfer your domain to a different registrar, usually by looking like a renewal bill. In 2003 the FTC said one company mailed millions of notices that appeared to be renewal notices from consumers' current registrars, and a court order barred it from similar conduct.

### Do I need to pay to submit my website to search engines?

No. Google says it never accepts money to include or rank sites in its search results, and that it costs nothing to appear in organic results. An invoice for "search engine registration" or "submission" is selling something you don't need, often worded to look like a bill you owe.

## Sources

- [ICANN: Be careful what you click: alert of new fraudulent domain renewal emails (September 2014)](https://www.icann.org/en/blogs/details/be-careful-what-you-click-alert-of-new-fraudulent-domain-renewal-emails-29-9-2014-en)
- [ICANN: Expired Registration Recovery Policy (updated 21 February 2024)](https://www.icann.org/en/contracted-parties/consensus-policies/expired-registration-recovery-policy/expired-registration-recovery-policy-21-02-2024-en)
- [ICANN: Launching RDAP; sunsetting WHOIS (January 2025)](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en)
- [ICANN: EPP status codes: what do they mean, and why should I know?](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en)
- [FTC: Court bars Canadian company from misleading consumers in marketing of internet domain name services (December 2003)](https://www.ftc.gov/news-events/news/press-releases/2003/12/court-bars-canadian-company-misleading-consumers-marketing-internet-domain-name-services)
- [FTC: Scams and your small business: a guide for business (July 2023)](https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business-0)
- [Google Search Central: Do you need an SEO?](https://developers.google.com/search/docs/fundamentals/do-i-need-seo)
- [RFC 9083: JSON Responses for the Registration Data Access Protocol (RDAP)](https://www.rfc-editor.org/rfc/rfc9083.html)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/domain-renewal-scam-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt