The Uniform Domain-Name Dispute-Resolution Policy, or UDRP, is an administrative process created by ICANN in 1999 that lets a trademark owner take a domain away from someone who registered it in bad faith. You file a written complaint with an approved dispute provider, a panelist reviews the record, and the winner sees the domain transferred or cancelled. No courtroom, no discovery, no damages.

To win, you must prove three elements: the domain is identical or confusingly similar to a mark you hold rights in, the registrant has no rights or legitimate interests in the name, and the registrant registered and is using the domain in bad faith. Miss one element and the complaint fails. Run properly, the process takes about two months and starts near US$1,500 in provider fees.

What the UDRP covers, and what it doesn't

The policy is written into the registration agreement for every generic top-level domain: .com, .net, .org, and the hundreds of newer strings like .shop and .app. Anyone who accepts one of those domains has already agreed to a UDRP proceeding if a trademark owner starts one. Approved providers run the process, the two most active are the World Intellectual Property Organization's Arbitration and Mediation Center and the Forum, formerly the National Arbitration Forum.

One flag before anything else: the UDRP is not a statute. It is a contract-based policy enforced through registrar agreements, and panels apply its text plus twenty-plus years of accumulated decisions, not any single country's law. Country-code domains are a different story. Many ccTLDs run their own procedures, Nominet's Dispute Resolution Service for .uk and the ADR process for .eu are the best-known, and their standards differ in wording and outcome. If your dispute involves a ccTLD, that registry's policy governs, not this one.

The UDRP is also trademark-only. It exists to fix cybersquatting: domains registered to exploit someone's mark. If a site copied your content but never traded on your brand, the name itself is not the problem, and the copyright route applies instead. Knowing where trademark and copyright split decides which process you should be in.

The three elements every UDRP complaint must prove

Paragraph 4(a) of the policy sets the test, and every panel runs it in order. All three elements must be established. There is no balancing test, and sympathy is not an element.

  1. Identical or confusingly similar. The panel compares your mark against the part of the domain before the dot. The extension rarely matters. Added words, hyphens, and misspellings almost never save a registrant: "yourbrandshop.com" and "y0urbrand.com" both pass this element against YOURBRAND.
  2. No rights or legitimate interests. You make a prima facie showing that the registrant has no legitimate connection to the name. Once you do, the burden shifts to them to prove one.
  3. Registered and used in bad faith. Both halves matter. A domain registered in 2005 cannot have been registered in bad faith to exploit a mark that first acquired rights in 2015. Timing defeats more complaints than any other defect. A minority of panels have entertained bad-faith-renewal theories, but the mainstream rule holds: rights that arose after registration generally kill the complaint.

Common-law rights count, and trademark registrations from any country count, not just US ones. What you cannot do is file on a name you like but never used commercially.

Bad-faith indicators UDRP panels weigh

Paragraph 4(b) names four circumstances that operate as evidence of bad faith. They are illustrations, not a checklist, panels weigh any conduct that fits the concept.

  • The domain was registered mainly to sell it to the mark owner or a competitor for more than documented out-of-pocket costs.
  • It was registered to keep the mark owner from getting the name, as part of a pattern of such registrations.
  • It was registered mainly to disrupt a competitor's business.
  • It is being used to pull in traffic for commercial gain by creating confusion, pay-per-click pages keyed to your terms, affiliate redirects, that sort of thing.

Panels also read the surrounding facts. A domain listed for sale on a broker site is a classic. So is a prior UDRP history showing a pattern, a site that borrows your branding to imply affiliation, and a site whose content is lifted wholesale from yours. If someone copied your website and parked it on a confusing domain, they are building your bad-faith record for you.

Registration behind a privacy service deserves a note. Concealment alone is not bad faith; panels have said so repeatedly. But privacy combined with other red flags can sharpen a panel's reading of intent.

What a UDRP complaint must actually show

The complaint is a formal written filing, and the provider screens it for compliance before anything moves. It must identify the complainant, the registrant as listed in WHOIS, the disputed domain, and the registrar. It must state your mark and the basis for your rights, registration numbers and jurisdictions, or dated evidence of common-law rights such as sales, advertising, and press. It must lay out facts supporting each of the three elements, state the remedy sought, and certify the filing is complete and not an abuse of the process. You also designate a mutual jurisdiction, normally the court at the registrar's principal office or at the respondent's WHOIS address, and you are committed to that court if the dispute escalates.

Naming the right respondent matters more than most people expect. The respondent is the WHOIS registrant, not the host, not whoever answers the contact form. Providers check the registrar's record, and a mismatch stalls the case at the door. Identifying who owns the domain is step one, and our Website Detective tool exists to capture that record before you file.

Many complainants send a demand letter first. Sometimes that works. Sometimes it burns you: the registrant scrubs the for-sale listing before you capture it, or bolts on a thin blog to manufacture a legitimate use. The same calculus that separates a cease-and-desist letter from immediate formal action applies here. Send the letter only when it preserves the evidence you need.

UDRP cost and timeline versus federal court

Provider fees set the floor. WIPO's published schedule has long sat at roughly US$1,500 for a single-panelist case covering up to five domains, and around US$4,000 for a three-member panel. The Forum prices in the same range. Fees get adjusted, so verify the current schedule before budgeting. Drafting help costs extra, but the whole job still costs less than a single court filing. One quirk: if the respondent requests the three-member panel, WIPO's rules split that panel fee between the parties.

The calendar runs in fixed stretches. The respondent has 20 days to answer from notification. The provider appoints the panel within days of that window closing, and the panel must decide within 14 days of appointment. Once the registrar receives the decision, it implements within 10 business days, unless the respondent shows it has sued. Filing to transfer commonly lands around six to eight weeks, and a no-response case moves faster.

Federal court is the other road. The Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), lets you sue the registrant directly, or the domain itself, in rem, when the registrant cannot be found. Courts can order transfer and award statutory damages of $1,000 to $100,000 per domain at their discretion. The price is a year or more of litigation, usually at a cost the UDRP cannot approach. For most cybersquatting disputes, the speed-to-outcome ratio wins, the same fork content owners face when weighing a takedown against court orders.

Transfer outcomes: what a UDRP panel can and can't order

The panel's remedial menu has exactly two items: transfer the domain to the complainant, or cancel it. No damages, no costs, no fee shifting. That is the trade for speed, the UDRP buys you the name, not compensation.

Complainants almost always ask for transfer, and should. Cancellation sends the domain to the open market, where anyone, including another squatter, can register it the same day. Asking for cancellation because you did not plan the snap-back is a rookie mistake.

Most decided cases end in transfer. WIPO has tracked its caseload for decades, and complainant success has stayed consistently high, helped by the many cases that go unanswered. A meaningful share also settles before decision, nothing in the rules stops the parties from resolving privately mid-proceeding.

Default is not automatic victory. With no response, the panel still tests all three elements on the papers filed, and a thin complaint loses by default the same way it loses when contested. Panels can also declare Reverse Domain Name Hijacking when a complaint was filed in bad faith, for instance, knowing the respondent plainly had rights. That finding is public, follows the complainant, and poisons future filings.

After the decision, either side can still run to court. A UDRP decision gets reviewed fresh, with no deference. Through the proceeding, the registrar typically locks the domain so nobody transfers or re-registers it mid-fight. One of the earliest decisions set the tone: in early 2000, WIPO ordered the transfer of worldwrestlingfederation.com from a fan who had tried to sell the name back to the wrestling company.

Defenses that defeat a UDRP complaint

Respondents win by breaking any element, but Paragraph 4(c) names three situations that establish a legitimate interest:

  • Before notice of the dispute, the respondent used the domain for a bona fide offering of goods or services.
  • The respondent has been commonly known by the domain name, even without a registration, personal names, long-standing trading names, handles.
  • The respondent is making a legitimate noncommercial or fair use of the name, without intent to divert consumers for commercial gain or to tarnish the mark.

Legitimate noncommercial use is the defense panels test hardest. Genuine criticism and gripe sites built on "yourbrandsucks" domains usually qualify. So do fan sites that do not monetize the mark. A "review site" padded with affiliate links and pay-per-click ads usually fails, because commercial gain riding on confusion is exactly what the element forbids.

Other recurring defenses:

  • Timing. A registration that predates the complainant's rights defeats bad faith with most panels.
  • Generic use. Using a common word for its plain meaning. A computer maker will not take apple.farm away from a grower on the word alone.
  • Reseller rights. Panels trace this line to an early WIPO decision involving an authorized reseller of Oki Data printers: a reseller keeps a domain when it genuinely sells the complainant's goods, uses the site only for that, and accurately discloses the relationship.
  • Delay. Pure delay is not a recognized defense, panels have said so, but a complainant who sat on a domain for years will find the bad-faith story harder to sell.

None of this protects a registrant who registered the name to extort you and bolted on a blog after your letter arrived. Panels read pretexts for what they are.

When the UDRP is the wrong tool for a domain dispute

Plenty of domain disputes are not UDRP disputes, and filing in the wrong lane burns months you could have spent fixing the problem. The dividing line is what the domain is actually doing to you.

If the site copies your text, images, or code but never touches your brand, that is a copyright problem, not a trademark one. The fix is aimed at the content, here is how to file a DMCA takedown notice properly, not at the name. Content complaints also run on a different clock, so check how long DMCA takedowns take before you commit to a sequence, and note that DMCA takedown costs are priced per notice rather than per case, which matters when dozens of pages have been copied.

Some disputes deserve both lanes. A storefront that clones your shop and runs it on a confusing domain is a trademark fight and a content fight at the same time, the pattern behind many Etsy and Shopify copyright infringement cases, and the two processes complement each other rather than compete.

Impersonation splits the same way. A fake profile built around your name on a social platform is a platform-policy problem, and impersonation account removal moves faster through the platform than any domain body. And when the whole site is the problem, phishing, malware, wholesale piracy, the fastest route may be to report the website to its host and registrar directly.

For newer gTLDs there is also the Uniform Rapid Suspension system: faster and cheaper, but it only suspends the name for the rest of its registration term, and the proof standard is higher. Use it when a domain is causing damage right now and transfer can come later.

UDRP questions, answered directly

How long does a UDRP case take from filing to transfer?

Count the fixed stretches: 20 days for the response, roughly 14 days for the panel to decide once appointed, and 10 business days for the registrar to implement. Most contested cases conclude in six to eight weeks, and defaults move faster. The only real pause comes if the respondent runs to court, which is rare.

How much does a UDRP complaint cost compared with litigation?

Provider fees start around US$1,500 at WIPO for a single panelist and about US$4,000 for a three-member panel; the Forum charges in the same range. Professional drafting adds a service fee but stays modest next to litigation. A federal ACPA case routinely runs well into six figures over a year or more, which is why most trademark owners start here.

Can a UDRP panel award damages or attorney fees?

No. A UDRP panel has two remedies: transfer or cancellation. No money, no costs, no fee shifting. If the squatter has been monetizing your mark, federal court under the Anticybersquatting Consumer Protection Act offers statutory damages of $1,000 to $100,000 per domain, plus transfer, at the cost and pace of full litigation.

Does the UDRP apply to domains registered outside the United States?

Yes, for gTLDs. Every .com, .net, and .org registration worldwide accepts the policy, wherever the registrant lives. Country-code domains differ: .uk, .eu, .ca, and most other ccTLDs run their own procedures with their own standards, so read that registry's policy before assuming you have a UDRP case.

What happens if the respondent ignores the complaint?

The panel decides on the papers filed. Default is common, and a well-documented complaint usually ends in transfer. But default skips nothing, the panel must still establish all three elements, and a complaint with thin bad-faith evidence loses even when nobody responds.

What to do today

  1. Confirm the policy applies. gTLDs are covered automatically; a ccTLD means checking that registry's rules first.
  2. Freeze the evidence now. Dated WHOIS records, screenshots of any for-sale listing, archives of the site's use. Bad-faith evidence spoils fast.
  3. Compare your dates. Rights that began after the domain was registered put the bad-faith element in serious trouble. Reassess before spending anything.
  4. Pick the lane. UDRP for the name, DMCA for the content, platform reports for impersonation. Run them in parallel where the facts support it.
  5. Send a demand letter only if it preserves evidence. If the letter just alerts the registrant, skip it and file.
  6. Match firepower to stakes. A clear-cut single-domain case is manageable; a portfolio dispute or a matter heading toward an ACPA lawsuit calls for trademark counsel.
  7. Get help drafting if the facts are messy. A complaint built inside the three elements wins; one built around them invites a Reverse Domain Name Hijacking finding. This is the work we do every week, see our pricing for commercial and personal takedown plans, and if copycat domains keep appearing against your business, our brand protection service adds monitoring so the next one gets caught early.