Where the notice goes
To the registrant contact, which is whoever registered the domain. For a business of any age that is frequently a person who has left, an agency that no longer works with you, or a personal address belonging to someone who now ignores anything from that registrar.
Worse, and more common than it should be, the contact address is sometimes at the very domain that is about to expire. When the domain lapses the mailbox stops too, so the escalating warnings arrive nowhere.
What the notice assumes
That auto-renew will handle it. Most notices are framed as confirmations rather than warnings, because from the registrar's point of view the renewal is expected to succeed.
Then the card on file expires. Cards get reissued every few years, and nobody thinks of a domain registrar when updating payment details. The charge fails, a notice goes to the same address as everything else, and the reassuring auto-renew confirmations stop arriving without anyone noticing an absence.
Why absence is the hard part
Noticing that something has arrived is easy. Noticing that something stopped arriving is close to impossible without a system, because there is no moment at which it happens. This is the same reason broken mail authentication runs for months: silence is not an event.
The three things that actually work
- A contact address that survives an individual leaving. Not personal, and not at the domain in question.
- A second contact, so a single unread inbox is not the whole defence.
- The renewal date recorded somewhere other than the registrar's email, because that channel is the one that failed.
What this is really about
None of the above is technically difficult, and none of it is what causes lapses. Lapses happen because a process depended on a person, and the person moved on while the process kept appearing to work. That is an organisational failure rather than an administrative one, and it happens most often to organised businesses with staff turnover, not to disorganised ones.