# QR code goes to a dead domain

> A lapsed domain is the worst QR failure, because after roughly 30 days of grace and a 30-day redemption period anyone can re-register it — including an attacker who inherits every code you ever printed. If it is yours, restore it during redemption. Then turn on auto-renew, add years, and lock the registrar account.

Source: https://useqr.app/docs/troubleshooting/qr-code-goes-to-a-dead-domain · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## Why this is the worst destination failure

A [404](/docs/troubleshooting/qr-code-opens-a-404) is a broken link. A lapsed domain is a **transferable asset**: once it is released, whoever registers it next inherits every scan from every code you ever printed — posters, packaging, business cards, all still out in the world, all still sending traffic. At best the new owner parks it with ads. At worst it becomes a lookalike login page harvesting the credentials of people who trusted *your* printed material — the [quishing](/docs/security/quishing-explained) attack with the hardest part, distribution, already done for the attacker. Printed QR codes make domain expiry a physical-world security problem.

## The clock — what happens when a domain lapses

For typical gTLDs (.com, .org, .net and most new extensions):

| Phase | Typical length | What you can do |
|---|---|---|
| Expired — registrar grace | 0–45 days, varies by registrar | Renew at the normal price |
| Redemption period | 30 days | Restore it, with a fee well above the renewal price |
| Pending delete | 5 days | Nothing — wait, and prepare to re-register |
| Released | — | Anyone can register it, including drop-catch services |

Country-code TLDs run their own timelines, sometimes much shorter. Drop-catching services register desirable names within moments of release, so "I'll just re-register it next week" is not a plan.

## If it is — or was — your domain

Act immediately: every day moves you toward a worse phase and a higher price. In grace, renew normally; in redemption, pay the restoration fee without hesitating — it is cheap against reprinting an estate of codes. If the domain has already been taken by someone else, treat every printed code as **compromised, not merely broken**: physically remove or cover them, and tell your audience through another channel not to scan old materials.

## If it is someone else's domain

You printed a partner's URL, a vendor's, a shortener's — and their domain died. You cannot rescue a domain you never owned, so withdraw the codes and check what loads now: a parked page is a warning, a lookalike login form is an active incident worth reporting. Decode any suspect code with our [scanner](/scan) to see the raw URL without visiting it — the safe-checking routine is at [how to check a QR code before opening it](/docs/security/how-to-check-a-qr-code-before-opening).

## Prevention

- **Auto-renew, plus years in the bank.** Register the domain years ahead — renewal is cheap and the failure is not.
- **Fix the mundane root cause.** Most accidental expiries trace to an expired payment card silently failing auto-renewal. Keep a backup card on the registrar account and treat registrar emails as production alerts.
- **Lock it.** Enable transfer lock; for a high-value domain, ask about registry lock.
- **Inventory the printed estate.** Keep a list of every URL you have ever printed and check each one on a schedule — printed codes outlive [campaigns, tools and memories](/docs/basics/do-qr-codes-expire), and this failure is only cheap when caught in the grace period.

## FAQ

### What happens to QR codes when the domain expires?
Every printed code keeps sending scanners to that domain — first to an error or parking page, and after re-registration to whatever the new owner chooses to host. The codes cannot be recalled; only the domain's fate decides where they lead.

### Can someone take over my old QR codes?
Yes. Once a lapsed domain is released, anyone can register it and instantly controls the destination of every code that references it. Re-registered domains behind trusted printed materials are an established phishing pattern.

### How long do I have to recover an expired domain?
Typically a registrar grace period of up to 45 days at normal price, then about 30 days of redemption at a higher restoration fee, then around 5 days of pending delete. After that it is open to anyone, including drop-catchers.

### Is a parked page at my old QR destination dangerous?
It is a warning shot: the domain has changed hands and now serves ads. The danger is what it can become overnight — the new owner can host anything, so treat printed codes pointing there as compromised and withdraw them.

## Try it

- https://useqr.app/scan
- https://useqr.app/url
- https://useqr.app/validate