QR code goes to a dead domain

Why this is the worst destination failure

A 404 is a broken link. A lapsed domain is a transferable asset: once it is released, whoever registers it next inherits every scan from every code you ever printed, posters, packaging, business cards, all still out in the world, all still sending traffic. At best the new owner parks it with ads. At worst it becomes a lookalike login page harvesting the credentials of people who trusted your printed material: the quishing attack with the hardest part, distribution, already done for the attacker. Printed QR codes make domain expiry a physical-world security problem.

The clock: what happens when a domain lapses

For typical gTLDs (.com, .org, .net and most new extensions):

Phase	Typical length	What you can do
Expired, registrar grace	0–45 days, varies by registrar	Renew at the normal price
Redemption period	30 days	Restore it, with a fee well above the renewal price
Pending delete	5 days	Nothing: wait, and prepare to re-register
Released	n/a	Anyone can register it, including drop-catch services

Country-code TLDs run their own timelines, sometimes much shorter. Drop-catching services register desirable names within moments of release, so "I'll just re-register it next week" is not a plan.

If it is (or was) your domain

Act immediately: every day moves you toward a worse phase and a higher price. In grace, renew normally; in redemption, pay the restoration fee without hesitating. It is cheap against reprinting an estate of codes. If the domain has already been taken by someone else, treat every printed code as compromised, not merely broken: physically remove or cover them, and tell your audience through another channel not to scan old materials.

If it is someone else's domain

You printed a partner's URL, a vendor's, a shortener's, and their domain died. You cannot rescue a domain you never owned, so withdraw the codes and check what loads now: a parked page is a warning, a lookalike login form is an active incident worth reporting. Decode any suspect code with our scanner to see the raw URL without visiting it: the safe-checking routine is at how to check a QR code before opening it.

Prevention

• Auto-renew, plus years in the bank. Register the domain years ahead: renewal is cheap and the failure is not.
• Fix the mundane root cause. Most accidental expiries trace to an expired payment card silently failing auto-renewal. Keep a backup card on the registrar account and treat registrar emails as production alerts.
• Lock it. Enable transfer lock; for a high-value domain, ask about registry lock.
• Inventory the printed estate. Keep a list of every URL you have ever printed and check each one on a schedule: printed codes outlive campaigns, tools and memories, and this failure is only cheap when caught in the grace period.

FAQ

What happens to QR codes when the domain expires?

Every printed code keeps sending scanners to that domain: first to an error or parking page, and after re-registration to whatever the new owner chooses to host. The codes cannot be recalled; only the domain's fate decides where they lead.

Can someone take over my old QR codes?

Yes. Once a lapsed domain is released, anyone can register it and instantly controls the destination of every code that references it. Re-registered domains behind trusted printed materials are an established phishing pattern.

How long do I have to recover an expired domain?

Typically a registrar grace period of up to 45 days at normal price, then about 30 days of redemption at a higher restoration fee, then around 5 days of pending delete. After that it is open to anyone, including drop-catchers.

Is a parked page at my old QR destination dangerous?

It is a warning shot: the domain has changed hands and now serves ads. The danger is what it can become overnight: the new owner can host anything, so treat printed codes pointing there as compromised and withdraw them.