Domain Name Disputes: How Contested Names Are Decided

By Bill Hartzer, domain name expert and expert witness·August 10, 2026

A Dispute Is Not a Theft

The most consequential judgment in this area gets made before anything is filed, and it is not a legal one. It is factual. Did the domain move without its registrant's authority, or is it sitting exactly where it has always sat, with a holder somebody else believes has no business holding it? Those are different problems. A stolen domain is a records failure to be reversed. A disputed domain was registered in the ordinary way, first come and first served, and the registrant holds it lawfully at the registry until a panel or a court says otherwise.

That distinction drives everything downstream. Every route to a disputed name — the UDRP, the URS, a lawsuit, a negotiated purchase — is an adversarial proceeding on the merits, with a party on the other side entitled to be heard. In my experience the most expensive early mistake is treating a dispute as though it were a theft, escalating to abuse desks for weeks, and only then discovering that the fight was always going to be about trademark rights.

Cybersquatting — registering or holding a domain that matches somebody else's trademark, in bad faith, usually to sell it back at a profit or to trade off the name — is not a status you can read off a Whois record. It is a conclusion a decision-maker reaches after applying a test to evidence. The volume of that testing is substantial: the World Intellectual Property Organization, one of five approved dispute providers, records a cumulative 84,158 domain name cases through its center, including 6,168 filed in 2024. Those are WIPO's filings alone, not an all-provider total.

The Three Elements Every UDRP Complaint Must Prove

The UDRP — the Uniform Domain-Name Dispute-Resolution Policy, the contractual dispute process every generic top-level domain registrant agrees to at registration, decided on paper by a panel rather than in court — is incorporated by every ICANN-accredited gTLD registrar into its registration agreement. A gTLD is a generic top-level domain such as .com, .org or .app, as distinct from a two-letter country code. Because the policy is already in the contract, the registrant has consented in advance to a mandatory administrative proceeding before an approved provider: WIPO, the Forum, the Czech Arbitration Court, ADNDRC or CIIDRC. The case is decided by a panel — the one or three neutrals the provider appoints to decide it on the documents filed.

Under Paragraph 4(a) of the Policy, the complainant must prove all three of the following:

the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
the registrant has no rights or legitimate interests in respect of the domain name; and
the domain name has been registered and is being used in bad faith.

Read the third element again. It is conjunctive: registration in bad faith and use in bad faith, both. That one word carries more outcomes than any other in the policy, because it anchors the inquiry to the moment of registration. A domain registered before the complainant's mark existed generally cannot satisfy it — at the moment of registration there was nothing to target. Chronology is not a technicality here. It is frequently the whole case.

What Panels Treat as Bad Faith

Paragraph 4(b) sets out four circumstances that, if found, evidence bad faith registration and use. The list is expressly non-exhaustive, so it is a floor rather than a ceiling:

registering the domain primarily to sell, rent or transfer it to the mark owner or a competitor for consideration exceeding documented out-of-pocket costs;
registering the domain to prevent the mark owner from reflecting the mark in a corresponding domain, where the registrant has engaged in a pattern of such conduct;
registering the domain primarily to disrupt the business of a competitor; and
using the domain to intentionally attract users, for commercial gain, by creating a likelihood of confusion as to source, sponsorship, affiliation or endorsement.

Each of those is an evidentiary proposition, not an adjective. The fourth depends entirely on what the domain was doing while it resolved, which is why preserving evidence matters more than argument. Full-page captures of the resolving site, the sale offer and the consideration named in it, the schedule of other domains the same holder registered — that is what a panel can act on. Bad faith asserted in the abstract reads as thin on the page.

What a Registrant Can Say in Answer

Paragraph 4(c) gives the registrant three answers, also non-exhaustive. Any one of them, if demonstrated, establishes rights or legitimate interests and defeats the complaint at the second element:

use of, or demonstrable preparations to use, the domain in connection with a bona fide offering of goods or services — genuine commercial use, not a pretext assembled after the fact — before any notice of the dispute;
being commonly known by the domain name, even without holding trademark rights; or
legitimate noncommercial or fair use of the domain, without intent for commercial gain to misleadingly divert consumers or tarnish the mark.

The timing qualifier on the first answer does real work. Preparations begun after the registrant learns of a dispute do not count, which is why a site that appears the week after a demand letter tends to hurt rather than help. The mirror-image point applies to complainants: these defenses are worth testing before filing rather than discovering in the response.

The Remedies Are Deliberately Narrow

A UDRP panel can order the domain cancelled or transferred to the complainant. That is the entire remedial universe. No damages, no costs, no injunction, no order about anything other than the domain names named in the complaint. People arrive at the UDRP expecting a judgment and leave with a registry record change, and the gap between those two things is worth understanding before committing to the route.

The URS — Uniform Rapid Suspension, a fast track built for clear-cut cases — is narrower still. A successful URS complaint suspends the domain for the balance of the registration period and redirects its nameservers to an informational page; the Whois record is otherwise unchanged and the name stays with the registrant. The registration stays where it is. If what you need is the domain, the URS does not deliver it.

Litigation is where money lives. In the United States, the Anticybersquatting Consumer Protection Act attaches liability, and with it statutory damages, in a way no administrative proceeding does. That difference — a records change versus a judgment — is usually the honest basis for choosing a route.

Three Regimes, and the Jurisdictions They Reach

The three routes do not overlap neatly, and their reach follows from where their authority comes from.

The UDRP and the URS are contractual. They bind because the registrant agreed to them in the registration agreement, which is why they operate worldwide across gTLDs without any court's involvement. The ACPA is statutory and United States federal law only; it reaches whoever a US court can reach, plus, through its in rem provision — a suit brought against the property itself rather than against a person — the domain in the judicial district of the registrar or registry where the registrant cannot be found or personal jurisdiction cannot be obtained.

ccTLDs, the two-letter country-code extensions run under national rules, sit outside both unless their registry has voluntarily adopted the UDRP. Nominet operates its own Dispute Resolution Service for .uk, and other country registries run their own policies with their own standards, deadlines and remedies. A .uk problem is not a UDRP problem, and assuming otherwise costs a filing cycle.

The Clock Everyone Underestimates

The Rules for the UDRP set a compressed timetable, and the deadlines are the part of the process most often missed by people encountering it for the first time.

Response: 20 days from commencement of the proceeding, under Rules Paragraph 5, with an automatic four-day extension available on request.
Panel appointment: within 5 calendar days of the provider's receipt of the response, for a single-member panel, under Paragraph 6.
Decision: within 14 days of the panel's appointment, absent exceptional circumstances, under Paragraph 15.
Implementation: 10 business days after the provider notifies the registrar of a cancellation or transfer decision, under Policy Paragraph 4(k).

That last window is the one that catches people. Within those ten business days, a losing registrant who files documented court proceedings in the mutual jurisdiction — the court location the complainant designated when filing, and where a losing registrant may file to stop a transfer — suspends implementation of the decision. Let the window lapse and the registrar moves the name. I have seen the ten days consumed by finding counsel, and a registrant who might have had a case in court lose the name to a calendar.

Where Disputes Go Wrong

The failure modes repeat, on both sides.

Reading element three as disjunctive. Bad faith use alone does not satisfy a policy that requires bad faith registration as well.
Filing after a failed purchase. Approaching the registrant, being refused or quoted a high price, and then filing on the strength of that price is a recognized pattern — and one that panels have treated as evidence the complaint was abusive rather than as evidence of squatting.
Filing for money. The UDRP has no damages remedy. If the objective is compensation, the administrative route cannot produce it.
Expecting a URS win to transfer the name. It suspends. That is all it does.
Splitting a bulk registrant into separate complaints. The Rules contemplate multiple domains in a single complaint where the same holder is involved, and one consolidated proceeding tells the pattern story that individual filings cannot.
Defaulting. If you file nothing, the panel is left with the complaint and nothing else, and panels decide on the record in front of them.

When the Complaint Itself Is the Abuse

The policy contemplates the mirror-image wrong. Reverse domain name hijacking is defined in the Rules as using the Policy in bad faith to attempt to deprive a registered domain-name holder of a domain name, and Rules Paragraph 15(e) requires that where a panel finds a complaint was brought in bad faith — for instance as an attempt at reverse hijacking, or primarily to harass the holder — the panel shall declare it in the decision as an abuse of the administrative proceeding. The declaration is mandatory once the finding is made. Making the finding is discretionary, and panels have consistently held that a complaint merely failing is not enough to justify one.

Which brings me to the thing this page cannot do for you. What is written here describes how these proceedings run and what the policies say. It is not advice about your matter, and no page can be. Dispute proceedings turn on trademark rights, evidence and the standards a panel or court will apply, they run on deadlines measured in days, and in the UDRP the practical consequence of losing arrives within ten business days. Anyone contemplating filing a complaint, or answering one, needs trademark counsel who does this work. That is not a hedge. It is the single most useful sentence on this page.

Frequently Asked Questions

Is a UDRP the right route for a domain that was stolen?

Generally no, and the confusion is costly. The UDRP tests whether a registrant registered and used a domain in bad faith against someone else's trademark rights. A stolen domain is a different fact pattern entirely: the registrant did not consent to the transfer, and the question is whether an unauthorized change to the registry record can be reversed. The UDRP's three-element test does not fit that, and running a dispute proceeding while a theft window is open wastes the time that matters most. Establish which problem you have before choosing a mechanism.

Can a UDRP panel award damages or legal costs?

No. The remedies available under the Policy are cancellation of the domain name or its transfer to the complainant, and nothing else. No damages, no costs, no injunction. This surprises people regularly, particularly where a squatted domain has caused real commercial harm. If compensation is the objective, the administrative proceeding is structurally incapable of delivering it, and that points toward litigation instead. In the United States, the Anticybersquatting Consumer Protection Act is the statute that carries monetary consequences.

What happens in the ten business days after a decision?

Under Policy Paragraph 4(k), once the provider notifies the registrar of a decision to cancel or transfer, the registrar waits ten business days before implementing it. During that window a losing registrant who files documented court proceedings in the mutual jurisdiction suspends implementation. If nothing is filed, the registrar acts and the name moves. It is a short window, it is measured in business days rather than calendar days, and it closes whether or not the losing party has found counsel yet.

Do these policies apply to country-code domains like .uk or .de?

Not automatically. The UDRP and URS bind gTLD registrants because ICANN-accredited gTLD registrars incorporate them into the registration agreement. Country-code top-level domains are run under national rules, and each registry sets its own dispute policy unless it has voluntarily adopted the UDRP. Nominet, for instance, operates its own Dispute Resolution Service for .uk. The elements, the evidence expected, the deadlines and the remedies can all differ, so a country-code dispute has to be run against that registry's own policy text.

Does it matter that the domain was registered before the trademark?

It usually matters a great deal. The third UDRP element requires that the domain was registered in bad faith and is being used in bad faith — both halves, conjunctively. Where the registration predates the complainant's trademark rights, there was nothing to target at the moment of registration, and panels generally find the element cannot be satisfied. This is why establishing the chronology from the Whois and RDAP registration-data lookups, and from the historical record, is the first analytical step for complainants and registrants alike.

Who decides a UDRP case, and is there a hearing?

An approved dispute resolution provider appoints a panel of one or three neutrals, who decide on the documents submitted. There is no trial, no witness testimony in the ordinary sense, and the timetable is short: a single-member panel is appointed within five calendar days of the provider receiving the response, and the decision is due within fourteen days of appointment absent exceptional circumstances. Everything the panel will consider has to be in the filings, which is why the quality of the exhibits tends to decide close cases.

Domain Name Disputes