Start with what is happening now. Each answer gives us a more useful next step.
Pause at the message
A renewal email can be a genuine reminder, a marketing solicitation or an attempt to steal a login or payment. Do not use the email’s payment link to find out which. Keep the message for comparison.
Check what you actually own
Find the domain name in the notice. Sign in to your registrar using a bookmark or an address you already know, entered independently of the email. Check whether that exact domain is in your account, its expiration date, renewal status and payment method.
Does the notice match the registrar account?
Check the sender and invoice details against the registrar’s own support or billing history before acting. A match is useful evidence, not a reason to trust a link blindly.
Do not pay from the message. It may be another company’s solicitation or a phishing attempt. Confirm who administers the domain before dismissing a real expiration risk.
If you cannot find the account
Ask the person or IT provider who manages your domains. Review prior registrar invoices and your company records. Domain registration, DNS hosting and website hosting can be with different companies; a familiar hosting brand may not be the registrar.
If you already clicked or paid
If you entered credentials, sign in through the known registrar address, change the password, review account access and enable MFA where available. If payment details were submitted to a suspicious site, contact the card issuer. Save the message, URL and receipt for investigation.
What to tell us
Send the domain name, a screenshot of the email with its sender and destination link visible, the registrar shown in your records, and the expiration date shown in the real account. Do not send passwords or full card details.