Domains, DNS and SSL certificates: the forgotten deadline that takes a company offline

• No grace period At the end of the term, the .pt domain becomes inactive. There are 30 days to renew at an extra cost; after that, the name is removed and anyone can register it.
• The right holder The domain must be in the company’s name, never a former employee’s, an agency’s or a former provider’s.
• Shorter certificates Since 15 March 2026 they are valid for a maximum of 200 days; in 2029 this falls to 47.
• Centralised control A single inventory of domains, certificates and DNS, with automatic alerts.

The domain is the company’s address on the internet (company.pt). DNS works like a telephone directory that says where the website is and where email goes; MX records are the entries that point to the mail server. The SSL certificate is the padlock in the browser: it confirms the site’s identity and encrypts the communication.

If the domain expires, everything stops. If the certificate expires, the site stays online but with a danger warning. Each component may sit with a different provider, with different dates, and that is where deadlines get lost.

The .PT registration rules set out the sequence:

1. Renewal must be made before the end of the paid period.
2. Once that period ends, an additional 30-day window opens for renewal, but the domain becomes inactive: website and email stop working.
3. Renewing within that window costs more.
4. After the 30 days without renewal, the domain is removed and becomes available for registration by third parties.

Step 2 is what surprises companies: the impact is immediate, and emails sent by clients and suppliers during that interval may be lost. Step 4 is the worst-case scenario, because the name can be registered by someone who uses it to send fraudulent messages in the company’s name. We explain that risk in email fraud and altered invoices.

Under the rules of Associação DNS.PT, which manages .pt domains, the holder has an exclusive and renewable right to use the name. It is the holder who decides whether to renew, transfer or change it.

In the companies we review, the domain often turns out to be in the name of:

• A former employee Who looked after the website a few years ago;
• The agency behind the first website Which never transferred ownership;
• The former IT provider Who kept the credentials when the contract ended.

In every case, the company uses a name it does not control, and all it takes is a renewal notice sent to an abandoned mailbox. The rules also distinguish the holder from the managing entity (usually the registrar) and the technical contact, who manages the DNS zone. These can be external partners; the holder must always be the company. If you are thinking of changing IT partner, check this point first, as we explain in the guide to changing IT provider without losing control.

Certificate lifetimes are set by the CA/Browser Forum, which brings together certificate authorities and browser makers. In April 2025 a progressive reduction was approved:

With eight renewals a year for each certificate, manual renewal becomes unworkable. It has to be automatic, and someone has to confirm that the automation keeps working.

There is another sign: Let's Encrypt, one of the most widely used no-cost certificate authorities, stopped sending expiry warnings by email on 4 June 2025. Anyone relying on those warnings lost their safety net.

Company email, on Microsoft 365 or another service, depends on correct DNS records. MX records route the mail; SPF, DKIM and DMARC prove to other servers that the messages are legitimate and reduce spam and spoofing.

A careless change — for example when moving website hosting — can divert or block all mail without anyone noticing straight away. DNS changes should be made by someone who knows the full configuration, and they should be documented. See what typically goes wrong in email security in Microsoft 365.

At DataRoad, domains and certificates are treated like any server: they are included in the NOC and alert-based monitoring, they trigger an alert before the deadline and an engineer is responsible for acting. Monitoring is included in every IT Unlimited plan; IT Unlimited Premium adds unlimited on-site assistance.

Checklist for management:

• Domain inventory All of them, including old and brand domains, with holder, registrar and expiry date.
• Ownership Confirmed in the company’s name, with a contact email in a company mailbox.
• Automatic renewal Enabled, with a valid payment method.
• Certificate inventory Expiry date and renewal method for each one.
• Documented DNS A copy of MX, SPF, DKIM, DMARC and all other records.
• Alerts At 30 and 7 days before each deadline, to more than one person.
• Continuous checks The site responds and the certificate is valid.

In 2019, PTR Pharma Consulting moved its corporate website and email hosting to DataRoad’s servers, under an annual IT Unlimited contract that covers the rest of the infrastructure. Read the PTR Pharma Consulting case.

At Boost Portugal, the contract combines website hosting and domain registration with remote monitoring and availability reports. The principle is the same: one accountable party, one inventory, no forgotten deadlines.

DataRoad maps every domain, certificate and DNS record, confirms holders and deadlines and leaves the alerts configured. Request a no-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.

• .PT (Associação DNS.PT) — Registration rules for .pt domain names: pt.pt
• CA/Browser Forum — Ballot SC-081v3, reduction of certificate validity (11 April 2025): cabforum.org
• DNSimple — certificate validity timeline 2026–2029: support.dnsimple.com
• Let's Encrypt — end of the expiry email service: letsencrypt.org