n8n Domain Expiry Monitoring (And the DNS Drift Nobody Watches)

A Paid-Up Domain Can Still Go Dark Overnight

The point of n8n domain expiry monitoring is to never lose a domain to a calendar nobody checked. But there's a second failure that costs you just as fast: the domain stays registered while its DNS quietly changes underneath you. Both take the site down. Most workflows that rank for this watch neither well.

The strongest template, Track domain expiry dates with Google Sheets and WHOIS API, pulls the WHOIS SOA expiry into a sheet cleanly. But it runs manually and never alerts. The domain reminders version with WHOIS, Telegram and Ollama adds a notification but fires a single reminder. The community thread on domain expiry is a DIY scramble with no finished flow. None of them snapshot DNS.

n8n suits this because both checks (WHOIS expiry and live DNS resolution) are HTTP calls you can run on one schedule and reconcile against stored state.

What a Domain Monitor Should Actually Cover

A monitor that earns its keep watches the domain from two angles:

• Scheduled WHOIS check: read the registry expiry, don't wait for someone to click run
• Tiered renewal alerts: 60-day notice, 30-day alert, 7-day escalation
• DNS drift detection: snapshot nameservers and A records, alert on an unexpected change
• Missing-data fallback: handle TLDs where WHOIS doesn't return a clean date
• Multi-domain: one workflow over a portfolio, not one per domain
• History: log every check so a change is visible against a baseline

The Domain Monitoring Pipeline

Schedule Trigger (daily, 7am)
  → Code (load domain list from Sheets)
  → HTTP Request (WHOIS lookup per domain, continueOnFail: true)
  → IF (expiry date parsed?)
      → yes:
          → Code (daysLeft + tier: 60 / 30 / 7)
          → IF (tier changed?) → tiered alert
      → no:
          → Slack #ops (WHOIS returned no date — needs manual check)
  → HTTP Request (resolve nameservers / A record)
  → IF (resolved records != stored snapshot?)
      → Slack #incidents (DNS drift — possible hijack or misconfig)
  → Google Sheets (upsert expiry, tier, ns snapshot, checkedAt)

1. Put it on a schedule

A monitor you have to trigger by hand isn't a monitor. The ranking template's biggest miss is exactly this: it loads config and runs when you click. Wire a daily Schedule Trigger so the check happens whether or not anyone remembers. Domains lapse on weekends too.

2. Tier the renewal warning long

Domains need more lead time than certs. A lapsed domain can fall into a redemption period with recovery fees, or get registered by someone else the moment it drops. Fire a 60-day notice, a 30-day alert, and a 7-day escalation that reaches whoever actually holds the registrar login.

// Code node after the WHOIS lookup
const expiry = $json.expiry_date ? new Date($json.expiry_date) : null;
if (!expiry || isNaN(expiry)) {
  return [{ json: { domain: $json.domain, tier: "no_data" } }];
}
const daysLeft = Math.floor((expiry - Date.now()) / 86400000);
let tier = "ok";
if (daysLeft <= 7) tier = "critical";
else if (daysLeft <= 30) tier = "warning";
else if (daysLeft <= 60) tier = "notice";
return [{ json: { domain: $json.domain, daysLeft, tier } }];

That no_data branch matters. WHOIS doesn't return a clean expiry for every TLD, and a workflow that logs a blank and moves on hides the domains you most need to check by hand.

3. Watch the DNS, not just the calendar

This is the gap none of the incumbents fill. Resolve each domain's nameservers and primary A record every run, store the snapshot, and compare. An unexpected change is a loud signal: a hijack, a transfer you didn't authorize, or a DNS edit someone made without telling the team.

4. Log the baseline

Every check writes a row: domain, days left, tier, nameserver snapshot, timestamp. The DNS diff is only meaningful against a stored baseline, and the renewal escalation needs to know the last tier sent so it doesn't re-alert daily. The history is also what lets you prove the domain resolved correctly last Tuesday when someone asks.

Implementation Patterns

Pattern 1 — Diff against stored state, not against nothing. Both the renewal tier and the DNS snapshot only work if the previous value is saved. Read the stored row first, compare, write back at the end. The Supplier Verification & Monitoring Automation template uses this exact daily-check-then-diff-then-alert shape for vendor data, and the same skeleton drops onto domains.

Read stored snapshot → resolve now → IF (changed) → alert → write new snapshot

Pattern 2 — Escalate to the credential holder. The 7-day domain alert is useless if it lands in a channel the person with the registrar password never reads. Route the final tier to them directly.

Pattern 3 — One portfolio, one workflow. Keep domains in a Sheet. The loop scales by row, not by duplicated workflows.

Where This Breaks, and What to Watch

WHOIS isn't a clean, uniform feed. Different registries format the expiry field differently, some rate-limit aggressively, and a handful of TLDs don't expose a public date at all. A monitor that assumes every lookup returns a tidy expiry_date will quietly log blanks and tell you everything's fine. That's why the no_data branch isn't optional. Treat a missing date as a "check this one by hand" signal, not a pass.

Rate limits are the other trap. Loop fifty domains through a free WHOIS API in one burst and you'll start getting throttled responses that look like failures. Space the lookups out with a small wait between items, or batch the portfolio across a couple of staggered runs. The daily schedule gives you room: there's no reason to hammer the API in three seconds when you've got a 24-hour window.

DNS drift detection has a false-positive risk too. Some providers rotate through a pool of nameservers or use multiple A records behind a load balancer, so a naive "the record changed" check fires on a legitimate rotation. Normalize before you compare: sort the nameserver list, compare the set rather than the order, and only alert on a genuine addition or removal. A diff that pages on every benign rotation gets muted as fast as any other noisy alert, and then the real hijack slips through.

n8n Nodes You'll Use Most

Getting Started

1. Add a Schedule Trigger for a daily morning run.
2. Load domains from a Google Sheets read.
3. Add a WHOIS HTTP Request with continue-on-fail and a no_data branch.
4. Compute the renewal tier and compare against the stored row.
5. Resolve nameservers, diff against the snapshot, alert on a change.
6. Route the 7-day escalation to the registrar credential holder.
7. Log every check, then start from a template instead of wiring the diff logic twice.

For the certificate half of the same job, n8n SSL certificate monitoring uses the identical tiered-escalation pattern, and automating DevOps workflows with n8n shows where domain and DNS alerts fit in the broader on-call flow. For the endpoint-health side, pair this with AI Ops Watchtower.