UDRP Explained: Your Guide to Surviving Domain Name Disputes
By NorwegianSpark Editorial — written with AI assistance and reviewed by the NorwegianSpark SA editorial team
What the UDRP is, in one paragraph
The Uniform Domain-Name Dispute-Resolution Policy is an ICANN policy that every registrant of a generic top-level domain has already agreed to, whether or not they read it. It gives trademark owners an administrative route to have a domain transferred to them or cancelled, without going to court. If you register domains, you are inside it already.
This page is written for the person on the receiving end. Everything factual below is quoted from ICANN's own published Policy and Rules, checked at icann.org on 6 September 2026, because a page about a legal process that paraphrases the process badly is worse than no page.
The three things a complainant must prove
This is the heart of it. Paragraph 4(a) of the Policy states that a complainant must assert:
"(i) your domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; and (ii) you have no rights or legitimate interests in respect of the domain name; and (iii) your domain name has been registered and is being used in bad faith."
And then, in the Policy's own words: "In the administrative proceeding, the complainant must prove that each of these three elements are present."
Read the conjunctions. All three, not any of them. A trademark holder who proves only that your domain resembles their mark has proved one third of a case. This is the single most useful fact on this page, and it is the one most often lost in summaries that describe the UDRP as a way for brands to "claim" domains.
Note also the wording of the third element: "registered and is being used in bad faith". Both, not either.
What counts as bad faith
The Policy lists circumstances that, if found by the panel, are evidence of bad faith. Paraphrased tightly, they are:
- Acquiring the name primarily to sell it to the trademark owner or a competitor for more than your documented out-of-pocket costs.
- Registering it to stop the mark owner from using their own mark in a domain — but only where you have engaged in "a pattern of such conduct".
- Registering it primarily to disrupt a competitor's business.
- Using it to attract people for commercial gain by creating confusion with the mark as to source, sponsorship, affiliation or endorsement.
The list is explicitly non-exhaustive; the Policy says "in particular but without limitation". But the qualifiers matter enormously in practice. "Primarily", "documented out-of-pocket costs", and "a pattern" are the words that decide real cases.
What counts as a legitimate interest
Paragraph 4(c) is the defence, and it is worth knowing before you need it. Any of the following demonstrates rights or legitimate interests:
- Before any notice of the dispute, your use of — or "demonstrable preparations to use" — the name in connection with "a bona fide offering of goods or services".
- You have "been commonly known by the domain name, even if you have acquired no trademark or service mark rights".
- You are making "a legitimate noncommercial or fair use" of it, without intent for commercial gain to misleadingly divert consumers or to tarnish the mark.
The phrase to underline is "before any notice to you of the dispute". Preparations you make after a complaint arrives are worth nothing. Everything you can show is evidence of what you were doing beforehand — and that is a filing habit, not a legal skill.
The clock, exactly as the Rules set it
These are the deadlines from the Rules for Uniform Domain Name Dispute Resolution Policy. Miss the first one and you are relying on the panel to decide in your favour without hearing from you.
| Stage | What the Rules say |
|---|---|
| Provider forwards the complaint | Within three calendar days of receiving the complainant's fees |
| Your response is due | "Within twenty (20) days of the date of commencement of the administrative proceeding" |
| Automatic extension | You "may expressly request an additional four (4) calendar days", which the Provider "shall automatically grant" |
| Panel decision | "In the absence of exceptional circumstances", within fourteen (14) days of the panel's appointment |
| Before the registrar acts | The registrar waits "ten (10) business days" after being informed of the decision, per Policy paragraph 4(k) |
Two consequences follow that people do not expect.
Silence is not neutral. The Rules say that where a party "does not comply with any of the time periods established by these Rules or the Panel, the Panel shall proceed to a decision on the complaint", and that the panel "shall draw such inferences therefrom as it considers appropriate". You are not defaulting into a stalemate. You are defaulting into a decision made without your side of it.
The four-day extension is automatic and free. It is granted on request, not on merit. If a complaint lands while you are travelling, ask for it on day one rather than day nineteen.
What can and cannot happen to you
Paragraph 4(i) is short and worth memorising: "The remedies available to a complainant pursuant to any proceeding before an Administrative Panel shall be limited to requiring the cancellation of your domain name or the transfer of your domain name registration to the complainant."
So a UDRP cannot award damages, cannot award costs against you, and cannot order you to do anything other than lose the name. That is a genuinely limited downside compared with litigation — and it cuts the other way too, which is why some complainants go to court instead.
On fees, paragraph 4(g) says all Provider fees "shall be paid by the complainant", with one exception: if you elect to expand the panel from one member to three, the fees are split evenly. That is a real decision with a real price attached, and it is yours to make.
We are not publishing a figure for what a filing costs. Providers set their own fee schedules, they vary by the number of domains and panellists, and a stale number here is exactly the kind of thing a reader would act on. Take it from the Provider's own published schedule on the day.
Court is still available, and the ten-day window is how you reach it
Paragraph 4(k) preserves the right to go to court "before such mandatory administrative proceeding is commenced or after such proceeding is concluded". It then sets out the mechanism that makes the right meaningful: after an adverse decision, the registrar waits ten business days, and if within that window you supply "official documentation (such as a copy of a complaint, file-stamped by the clerk of the court) that you have commenced a lawsuit against the complainant", the registrar does not implement the decision.
Ten business days is not long. If you intend to litigate, that decision has to be made in advance of the decision arriving, not after it.
What happens to the domain while this runs
Two mechanical points that catch people out:
- The domain gets locked for the proceeding. Under the Rules the registrar applies a lock after being notified, and the registrant's data is frozen at that point — updates made after the lock window closes may simply be "addressed by the Panel in its decision".
- You cannot transfer your way out. ICANN's Transfer Policy requires the registrar of record to deny a transfer where there is "a pending UDRP proceeding that the Registrar has been informed of". Moving the name to a friendlier registrar mid-dispute is not an available move, and attempting it reads badly.
How to make yourself hard to beat, before anything happens
None of this is legal advice, and a domain with real value deserves an actual lawyer. But most of the work that decides a UDRP is clerical and happens years earlier.
- Search the marks before you register. National and regional trademark offices run free public databases, and so does WIPO. Five minutes there is cheaper than any part of this process.
- Keep dated evidence of use, or of preparations to use. Invoices, contracts, mockups, a commit history, an incorporation record, an advertising receipt. The Policy asks whether you were doing something real before notice; documents are how you answer.
- Keep your registrar contact details reachable. The proceeding commences whether or not you read the email. An abandoned mailbox is how registrants lose names they would have kept.
- Do not park a trademark-adjacent name on ads pointing at the mark owner's competitors. That configuration maps almost exactly onto the Policy's bad-faith examples, and it is often set up by default rather than by choice.
- Never offer to sell to a mark owner who contacts you first. The Policy's first bad-faith example is acquiring a name primarily to sell it to the mark owner above your documented costs. An enthusiastic reply to an enquiry has sunk cases that were otherwise arguable.
Country-code extensions play by different rules
The UDRP applies to generic top-level domains. Country-code registries each decide their own dispute policy: some adopt the UDRP directly, some run a national variant with different elements and different deadlines, and some route disputes through their own courts in their own language. If your dispute concerns a country extension, the first question is not "what does the UDRP say" but "what policy did this registry publish", and the registry's own site is where that answer lives. Our ccTLD guide covers how much these registries differ.
The honest summary
The UDRP is not a mechanism for large brands to take names from small registrants, and the three-element test is genuinely load-bearing. A generic word used for a real purpose is not easy to take. What the policy does catch, reliably, is registration that was opportunistic from the start — the name bought because of whose brand it echoed, parked or offered back.
If that describes nothing you have ever done, your exposure is low and your homework is a trademark search plus a folder of dated evidence. If it describes something in your portfolio, the time to fix it is now, not when a complaint arrives.
For the adjacent risks, how to protect your domain from hijacking covers losing a name to an attacker rather than to a panel, and how domain names are valued explains why an encumbered name is worth less than a clean one, not more.
Last updated:
