What Is the UDRP, and How Do Domain Disputes Get Resolved?

Someone has registered a domain that matches your brand, and it is pointing at a competitor, a parking page full of ads, or a "for sale" banner with a ridiculous price. Or the reverse: you have owned a perfectly ordinary domain for years and suddenly receive a legal-looking complaint demanding you hand it over. In both cases, the process that will most likely decide the outcome is the Uniform Domain-Name Dispute-Resolution Policy, better known as the UDRP. This article explains what the UDRP is, the three things a complainant must prove, how a case moves from filing to decision, what it costs, how respondents defend themselves, and what alternatives exist. If you are still working out whether a registration is abusive in the first place, start with what cybersquatting is.

What Is the UDRP?

The UDRP is a policy adopted by ICANN in 1999 that creates a fast, mostly online, arbitration-style procedure for resolving disputes over domain names that allegedly infringe trademark rights. It is not a law and not a court. It is a contractual obligation: every ICANN-accredited registrar must incorporate the UDRP into its registration agreement, and every registrant of a generic TLD such as .com, .net, .org, or most new gTLDs agrees to it when registering a domain.

That contractual structure is what makes the UDRP work. The registrant has already agreed to submit to a "mandatory administrative proceeding" if a third party complains, and the registrar has agreed to implement whatever decision the panel reaches.

A few characteristics define the UDRP:

• It is narrow. It only handles clear cases of abusive registration, often called cybersquatting. It is not designed for complex trademark disputes between two legitimate businesses.
• It is document-based. There are no hearings in the vast majority of cases. Each side submits written filings and evidence, and a panel decides.
• It is fast. Most cases are decided within roughly two months of filing.
• The remedies are limited. A panel can order the domain transferred to the complainant or cancelled. It cannot award money damages, legal costs, or injunctions.
• It does not block courts. Either party can go to court before, during, or after a UDRP case.

Which Domains Does the UDRP Cover?

The UDRP applies to all gTLDs operated under ICANN contracts. Many country-code TLDs have adopted the UDRP as-is or use their own variant. For example, .uk uses Nominet's Dispute Resolution Service, .ca uses CIRA's Domain Name Dispute Resolution Policy, and .au uses auDRP. Some ccTLDs have no dispute policy beyond the courts. Before filing anything, check which policy governs the specific TLD.

The Three-Part Test

Paragraph 4(a) of the policy sets out three elements. The complainant must prove all three, and the burden of proof is on the complainant throughout.

1. Identical or Confusingly Similar to a Trademark

The domain must be identical or confusingly similar to a trademark or service mark in which the complainant has rights. In practice:

• The complainant needs trademark rights, registered or unregistered (common law). A registered trademark in any jurisdiction usually satisfies this threshold.
• Panels generally ignore the TLD itself when comparing. brand.com, brand.shop, and brand.xyz are all treated as identical to "BRAND".
• Adding generic words rarely helps the respondent. brand-login.com or brandsupport.net will typically be found confusingly similar because the mark is recognizable within the domain.
• Deliberate misspellings, the classic typosquatting pattern described in what typosquatting is, are usually treated as confusingly similar.

This first element is a low bar and is satisfied in most cases.

2. No Rights or Legitimate Interests

The respondent must have no rights or legitimate interests in the domain name. Because proving a negative is hard, panels accept a prima facie case from the complainant, after which the burden of production shifts to the respondent to show some legitimate interest.

Paragraph 4(c) lists ways a respondent can demonstrate legitimate interests:

Defense under 4(c)	What it means in practice
Bona fide offering of goods/services	The respondent used the name for a genuine business before receiving notice of the dispute
Commonly known by the name	The respondent, a person or business, is actually known by that name, even without a trademark
Legitimate noncommercial or fair use	A genuine criticism site, fan site, or commentary, without intent to mislead consumers or tarnish the mark

The list is not exhaustive. Panels have also recognized, for instance, that registering a common dictionary word for its dictionary meaning can be a legitimate interest, as long as it is not used to target a trademark owner.

3. Registered and Used in Bad Faith

Finally, the domain must have been registered and is being used in bad faith. Paragraph 4(b) lists circumstances that are evidence of bad faith:

1. Registering the domain primarily to sell it to the trademark owner or a competitor for more than the documented out-of-pocket costs.
2. Registering it to prevent the owner from using the mark in a domain, provided there is a pattern of such conduct.
3. Registering it primarily to disrupt a competitor's business.
4. Using it to attract users for commercial gain by creating a likelihood of confusion with the complainant's mark, for example pay-per-click ads targeting the brand or a site imitating the brand.

Panels also routinely find bad faith in cases the list does not spell out, such as domains used for phishing, fraudulent email, or impersonation. Passive holding, where a domain sits unused, can still be bad faith if the mark is well known and there is no plausible good-faith use.

The important nuance is timing. Bad faith is assessed at the time of registration. If a domain was registered before the trademark existed, the complainant usually cannot prove bad-faith registration, except in narrow situations such as a registrant anticipating a not-yet-public brand launch.

How a UDRP Case Works, Step by Step

Step 1: Choose a Provider

UDRP complaints are filed with an ICANN-approved dispute resolution provider, not with ICANN or the registrar. Current providers include:

• WIPO Arbitration and Mediation Center (the largest by caseload)
• Forum (formerly the National Arbitration Forum)
• Czech Arbitration Court (CAC)
• Asian Domain Name Dispute Resolution Centre (ADNDRC)
• Arab Center for Domain Name Dispute Resolution (ACDR)
• Canadian International Internet Dispute Resolution Centre (CIIDRC)

Each provider follows the same Policy and the same ICANN Rules, plus its own supplemental rules and fee schedule.

Step 2: Gather Evidence and File the Complaint

The complainant files a complaint describing the domain, the trademark, and arguments on all three elements, with supporting annexes: trademark certificates, screenshots of the disputed site, correspondence with the registrant, and historical records.

Some of that evidence can be collected from the command line. RDAP gives you the registration date, registrar, and current status in structured JSON:

curl -sL https://rdap.org/domain/example.com \
  | jq '{status,
         events: [.events[] | {eventAction, eventDate}],
         registrar: [.entities[]? | select(.roles | index("registrar"))
                     | .vcardArray[1][] | select(.[0] == "fn") | .[3]]}'

The Internet Archive's CDX API shows when the domain was first captured and how often its content changed, which helps establish how it has been used over time:

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&output=json&fl=timestamp,statuscode,digest&collapse=digest&limit=20"

Each row is a capture with a distinct content hash, so you can open the earliest snapshots at https://web.archive.org/web/<timestamp>/example.com and screenshot them for the annex. The guide to checking a domain's history walks through these tools in more depth.

Step 3: Registrar Verification and Lock

After receiving the complaint, the provider asks the registrar to confirm the registrant's details. Under the UDRP Rules, the registrar must lock the domain within two business days of that request. This lock prevents the respondent from transferring the domain to another registrar or registrant to dodge the proceeding. You can see it in RDAP or WHOIS as a transfer- and update-prohibited status; what registrar lock is explains those status codes.

The lock is why "cyberflight" (moving a domain mid-dispute) has become much harder since ICANN's 2013 rule amendments.

Step 4: Notification and Response

The provider checks the complaint for administrative compliance, then formally notifies the respondent. The respondent has 20 days to file a response. Extensions are possible in limited circumstances. Many respondents never respond at all, and panels then decide on the complaint alone, though a default does not automatically mean the complainant wins. The complainant still has to prove all three elements.

Step 5: Panel Appointment and Decision

Either party can choose a single-member or three-member panel. A three-member panel costs more and is sometimes requested by respondents who want a broader range of views. The panel is expected to issue its decision within 14 days of appointment, and providers publish decisions online.

Step 6: Implementation

If the panel orders transfer or cancellation, the registrar waits 10 business days before implementing it. If, within that window, the respondent provides evidence that it has filed a lawsuit in an appropriate court, the registrar suspends implementation until the court case is resolved. Otherwise the domain moves to the complainant.

Typical Timeline

Stage	Approximate timing
Filing to formal commencement	A few days to about a week
Response deadline	20 days after commencement
Panel appointment	About 5 days after the response or default
Decision	Within about 14 days of appointment
Implementation waiting period	10 business days
Total, uncontested case	Roughly 6 to 10 weeks

How Much Does a UDRP Cost?

Provider fees depend on the provider, the number of domains, and whether the panel has one or three members. At WIPO, for example, the published base fees for one to five domains have been in the low thousands of US dollars for a single panelist, and roughly double or more for a three-member panel. Forum and other providers publish their own schedules, which have often been somewhat lower. Always check the provider's current fee schedule rather than relying on any number you read in an article, including this one.

On top of provider fees, most complainants pay a lawyer or domain specialist to draft the complaint. For a simple, well-documented case the legal cost can be modest; contested cases cost more. Respondents pay nothing to respond unless they request a three-member panel, in which case they split those costs.

Compared with litigation, the UDRP is usually far cheaper. Compared with simply buying the domain, it may or may not be. If a squatter is asking a small amount, a negotiated purchase through a domain escrow service can be faster and cheaper, although offering to buy can complicate a later bad-faith argument if you change your mind.

How to Defend Against a UDRP Complaint

If you receive a UDRP complaint about a domain you registered legitimately, do not ignore it.

1. Read the complaint and the deadlines carefully. The 20-day clock starts when the proceeding formally commences.
2. Collect proof of your registration date. RDAP and archived snapshots showing you owned the domain before the complainant's trademark existed are among the strongest defenses.
3. Document legitimate use. Business records, invoices, product pages, and evidence that you or your business are known by the name all support a 4(c) defense.
4. Show you did not target the complainant. If the domain is a dictionary word, a surname, or an acronym with many meanings, explain why you chose it.
5. Consider asking for a finding of Reverse Domain Name Hijacking (RDNH). Under Paragraph 15(e) of the Rules, a panel can declare that a complaint was brought in bad faith, for example when the complainant knew the domain predated its trademark. RDNH carries no financial penalty, but it is a public finding.
6. Get professional advice if the domain is valuable. A well-drafted response makes a real difference.

UDRP Alternatives

Option	Best for	Outcome
UDRP	Clear cybersquatting in gTLDs and UDRP-adopting ccTLDs	Transfer or cancellation
URS (Uniform Rapid Suspension)	Blatant cases in new gTLDs, needing a fast, cheap fix	Suspension only, until the registration expires
ccTLD dispute policies	Country-code domains, such as Nominet DRS for .uk	Usually transfer, rules vary
Court action (for example, ACPA in the US)	Cases needing damages, injunctions, or complex trademark issues	Transfer, damages, costs
Negotiated purchase	Low-priced domains or ambiguous ownership situations	Transfer by agreement

The URS uses a higher "clear and convincing evidence" standard and only suspends the domain, so the complainant does not get to use it. It is mainly useful for shutting down an obvious infringing site quickly.

Not every dispute is a trademark dispute. If the issue is that a web designer or former employee registered your company's domain in their own name, the UDRP is often not the right tool. See how to recover a domain registered under someone else for that situation.

Practical Tips for Complainants

• Register your trademark before you need it. Unregistered rights are harder and more expensive to prove.
• Act promptly. Delay is not a formal bar, but it can undermine arguments about confusion and harm.
• Do not overreach. Filing against a domain registered long before your mark exists risks an RDNH finding.
• Consolidate. One complaint can cover multiple domains held by the same registrant.
• Read prior decisions. WIPO's Jurisprudential Overview summarizes panel consensus on most recurring questions and is the closest thing the UDRP has to a rulebook beyond the Policy itself.

---

UDRP FAQ

Conclusion

The UDRP is a targeted tool for one problem: domains registered and used in bad faith to exploit someone else's trademark. Its strength is speed and cost, and its limits are deliberate. A complainant must show the domain is confusingly similar to its mark, that the registrant has no legitimate interest, and that the domain was both registered and used in bad faith. The only remedies are transfer or cancellation.

If you are a brand owner, prepare before you need it: register your marks, monitor for lookalike registrations, and document abuse as soon as you spot it. If you are a domain owner facing a complaint, respond on time with evidence of when and why you registered the name. In either role, understanding the three-part test is the best predictor of how a dispute will end.

Here are some useful references for going deeper on the UDRP:

1. ICANN: Uniform Domain-Name Dispute-Resolution Policy — the full text of the policy, including the three-part test and bad-faith factors.
2. ICANN: Rules for Uniform Domain Name Dispute Resolution Policy — the procedural rules covering deadlines, locks, and RDNH.
3. WIPO: Domain Name Dispute Resolution — WIPO's filing guidance, fee schedule, and searchable case decisions.
4. WIPO: WIPO Jurisprudential Overview 3.0 — a summary of panel consensus views on recurring UDRP questions.
5. ICANN: Uniform Rapid Suspension (URS) — the faster, suspension-only alternative for new gTLDs.