Buying an expired domain: best practices and red flags

Buying an expired domain is legal and can be smart, as long as you are buying a name you will build something real on. Good reasons include a short, brandable name, real type-in traffic, a rebrand, or a domain whose old links fit the site you plan to run. The risk is buying a name with a spam, adult, pharma or hacked past, a trademark problem, or a link profile you plan to exploit for unrelated content. Google's expired domain abuse policy targets that last case. Do the homework below before you bid, and expect to pay for a good name the same way you would pay for any other business asset.

We get asked about this often by clients who spot an old name on an auction list. Here is how the process works and how we would check a name before buying it.

How domains expire and drop

For generic top-level domains (gTLDs) like .com, .net and .org, ICANN's Expired Registration Recovery Policy sets the minimum steps. Country-code domains like .us or .co.uk follow their own registry rules, so check those separately.

Registrars and drop-catch services often call the short window between redemption and release "pending delete." ICANN's registrant pages do not use that term or give it a length, so treat any exact number you see as the registry's or vendor's description, not ICANN policy.

Where people find and buy expired domains

Most good expired names never reach open registration. They are sold before or right as they drop:

• Registrar expired auctions. GoDaddy's help center says most expired GoDaddy names are listed on GoDaddy Auctions 26 days after expiry, and you need an Auctions membership to bid. If the original owner renews, the auction is canceled and refunded. Winners must pay within 48 hours.
• Backorder and drop-catch services. Services such as NameJet and DropCatch try to register a name the moment the registry releases it. If more than one customer backordered the same name, it usually goes to a private auction among them. Read each service's terms for fees and refunds.
• Search tools. ExpiredDomains.net is a popular free list of expiring and deleted names you can filter by extension, age, archive history and more. Many registrars also offer domain monitoring that alerts you when a name you want changes status.

A backorder is not a guarantee. The old owner can renew at any point before release, and another service may catch the name first.

Legitimate reasons to buy one

• A brandable name. Short, easy to say and easy to spell beats almost any SEO argument.
• Type-in traffic. Some generic names get visitors who type them straight into a browser. Ask the seller for proof if they make this claim.
• A rebrand or merger. You are renaming the business, or you bought a company and want its old domain to point to yours.
• Relevant backlinks. The old site was about the same topic you will cover, and the links it earned make sense for your new site.

If your only reason is "it has a high authority score," slow down. Third-party authority metrics are estimates from SEO tool companies, not Google numbers.

What Google's expired domain abuse policy says

In March 2024, Google added expired domain abuse to its spam policies. The policy describes a domain bought and "repurposed primarily to manipulate search rankings" by hosting "content that provides little to no value to users." Google's examples include affiliate content on a former government agency site and casino content on a former elementary school site.

Google's March 2024 announcement adds that this "isn't something people accidentally do." It also says using an old domain is fine for "a new, original site that's designed to serve people first."

Note what the policy does not say. It does not say expired domains are banned, and it does not promise that an old domain's history will help you. The line is intent and value: an unrelated, low-value site built to ride an old reputation is the problem. A real business building a real site on a good name is not. Sites that break spam policies can rank lower or drop out of results, and Google can apply a manual action. For more on how Google judges content quality, see what Google thinks about AI writing.

Due diligence checklist

Run every one of these before you bid.

1. Check the Wayback Machine. Look at snapshots across the domain's whole history at web.archive.org. You are looking for adult content, pharma, gambling, payday loans, foreign-language spam, thin affiliate pages, or a sudden switch from a real business to a page of random articles. That last pattern often means the name was already flipped into a private blog network (PBN).
2. Look for signs of a hack. Archived pages with injected links, strange outbound links in footers, or spam pages under odd folders suggest the old site was compromised.
3. Review the backlink profile. SEO tools such as Ahrefs, Semrush and Majestic show which sites link to the domain. Ask: are the linking sites real? Do they relate to your topic? Would those links still make sense once your site lives there?
4. Scan the anchor text. Anchor text is the clickable words in a link. A natural profile is mostly brand names and plain URLs. Lots of exact keywords, pill names, casino terms or foreign-language spam anchors is a bad sign.
5. Accept the manual action blind spot. You cannot see a domain's past manual actions or security issues in Google Search Console until you own it and verify it. Treat warning signs seriously, because you will only learn the full story after you pay.
6. Search for trademark conflicts. Search the name in the USPTO's free Trademark Search system and do a plain web search for businesses using it. Under ICANN's UDRP, a trademark owner can win transfer or cancellation of a domain if it shows the name is identical or confusingly similar to its mark, the holder has no rights or legitimate interests in it, and it was registered and used in bad faith.
7. Check email reputation if you will send email. Look the domain up on major email blocklists. If it was used for spam, your messages may land in junk folders for a while. Setting up SPF and DMARC correctly helps, as covered in our post on DNS, SSL and email authentication.
8. Check social handles. If the brand matters, see whether the matching handles are free on the platforms you will use.
9. List the old site's important pages. Note any pages that earned links or traffic. You will decide later whether to rebuild, redirect or let them go.

Pricing and buying safely

• Set a ceiling before the auction starts. Auctions reward excitement. Decide what the name is worth to your business and stop there. Our guide to what a website is worth explains how buyers value traffic and links, which helps you avoid overpaying for metrics.
• Watch the last minutes. GoDaddy notes that late bids can extend an auction, so a "won" auction may not be over yet.
• Use escrow for private sales. If you buy directly from an owner instead of through a registrar auction, use a licensed escrow service so the money is released only when the domain is in your account. Never wire money to a stranger and hope.
• Check renewal costs. Premium and some new extensions renew at higher prices. Know the yearly cost before you buy.
• Plan for the transfer lock. Under ICANN's current Transfer Policy FAQ, a registrar may deny a transfer within 60 days of a new registration or a previous transfer, and a change of registrant can trigger a 60-day lock. ICANN's board adopted revised Transfer Policy recommendations in June 2026 that will roll out over time, so check icann.org for the current rules.
• Put it in the right name. Register the domain to your business, in an account your business controls. Our guide on who should own your domain and hosting covers this, and our GoDaddy domains and hosting post shows where the settings live if you buy there.

After you buy: use it the right way

1. Turn on registrar lock, auto-renew and two-factor login right away.
2. Verify the domain in Google Search Console with a DNS record, then check the Manual actions and Security issues reports. If you find a manual action from the old owner, fix what it describes and file a reconsideration request explaining the domain changed hands.
3. Build a site that fits the name. Original content that serves real visitors is the whole test.
4. Restore old pages only if you will keep them up. If the old site had a useful guide on your topic, rebuilding a better version can make sense. Do not restore pages just to catch their links.
5. Use 301 redirects only for a real merger or rebrand. Pointing a relevant old company domain at your site after you acquire or rename the business is normal. Redirecting an unrelated expired name to your site to pass its links is the kind of shortcut that invites trouble. If you are moving an old site's pages, follow our checklist for a redesign without losing SEO.

Red flags

A note on legal questions

This article is general information, not legal advice. Trademark law and UDRP outcomes depend on the facts, and a quick database search does not clear a name. If a domain is close to an existing brand, talk to a trademark attorney before you buy.

The short version

Buy an expired domain because you want the name and will build something real on it. Check its history, links, trademark status and email reputation first, set a price ceiling, and use it for a genuinely relevant site. If you want a second opinion on a name you are eyeing, or help building the site once you own it, talk to us.