The UDRP (Uniform Domain-Name Dispute-Resolution Policy) is the administrative procedure that lets a trademark owner take a domain name away from a cybersquatter without going to court. It is fast by legal standards, comparatively inexpensive, and binding on every registrant of a generic top-level domain through the registration agreement. It is also narrower than most people assume. The UDRP decides one question only: did this registrant register and use this domain name in bad faith to trade on someone else’s trademark? When the facts do not fit that question, the UDRP is the wrong tool, and filing anyway wastes money and can earn the complainant a finding of reverse domain name hijacking.
We handle both sides of that line at DNAccess. We use the UDRP to recover stolen and squatted domain names when the facts support it, and we steer clients away from it when they do not.
What the UDRP is and who it binds
ICANN (the Internet Corporation for Assigned Names and Numbers, the nonprofit that coordinates the global domain name system) adopted the UDRP in 1999 as a condition of registrar accreditation. Every ICANN-accredited registrar must include the policy in its registration agreement, which means that every registrant of a .com, .net, .org, .info or new gTLD (generic top-level domain) name has already agreed, by registering the name, to submit to a UDRP proceeding if a trademark owner files one. There is no opt-out; the agreement to arbitrate travels with the domain.
Country-code top-level domains (ccTLDs, the two-letter extensions such as .uk, .ca or .ai) are not under ICANN contract and are not automatically covered. Many ccTLD registries have adopted the UDRP outright or a local variant of it, and WIPO now serves some 87 ccTLD registries, according to the WIPO Secretariat’s 2026 update to the Standing Committee on the Law of Trademarks. Others, including .uk, run their own procedures with different elements and remedies. Before filing anything, confirm which policy actually governs the extension in dispute.
The UDRP is an administrative proceeding, not a lawsuit and not conventional arbitration. The panel’s decision binds the registrar, which must implement a transfer or cancellation order, but it does not bind the courts. Either party can take the same dispute to court before, during or after the proceeding, and a timely court filing by the losing registrant suspends implementation of the decision. That design is deliberate. The UDRP was built to clear the obvious cases of cybersquatting quickly while leaving genuinely contested rights to the courts.
Who administers UDRP cases
ICANN does not decide UDRP cases itself. It approves dispute resolution providers, each of which maintains a roster of panelists, publishes its own supplemental rules and fee schedule, and administers cases from filing through decision. The two providers that handle the overwhelming majority of complaints are the WIPO Arbitration and Mediation Center (the dispute service of the World Intellectual Property Organization in Geneva) and Forum (formerly the National Arbitration Forum, based in Minneapolis). Three smaller providers round out the list: the Czech Arbitration Court (CAC), the Canadian International Internet Dispute Resolution Centre (CIIDRC), and the Asian Domain Name Dispute Resolution Centre (ADNDRC).
The caseload is large and still growing. WIPO received 6,282 UDRP-based complaints in 2025, the largest number of filings it has ever recorded, and it has administered more than 80,000 UDRP-based cases since December 1999, according to the WIPO Secretariat’s report SCT/49/2.
Outcomes across all providers are lopsided in the complainant’s favor, which reflects the kind of case that gets filed. ICANN’s own status report, covering January 2013 through December 2020, counted 38,349 UDRP complaints involving 67,318 domain names; complainants obtained the disputed domain name in about 78 percent of cases, while panels made reverse domain name hijacking findings against complainants in about 2 percent, according to the ICANN GNSO’s revised UDRP Status Report. The policy is not automatic, though. The WIPO-ICA review team reported in 2025 that some 7,000 WIPO cases had been dismissed in favor of the registrant, according to the WIPO-ICA UDRP Review Project Team’s initial report.
The three elements a complainant must prove
Paragraph 4(a) of the policy sets out three elements, and the complainant has to prove all three. Failing any one of them loses the case. Panels take the third one seriously even when the first two are obvious.
The domain name is identical or confusingly similar to a trademark in which the complainant has rights
This is a threshold test, and it is usually the easiest of the three. The complainant must show that it holds trademark rights, registered or unregistered, and that the domain name is identical or confusingly similar to that mark. Panels compare the second-level string with the mark directly, ignore the top-level domain, and treat an added descriptive word, hyphen or misspelling as insufficient to avoid confusing similarity. A registered trademark anywhere in the world will normally satisfy the first element. Unregistered rights, often called common-law trademark rights in the United States, can also satisfy it if the complainant shows that the name has acquired secondary meaning, which is to say that the public associates the name with the complainant’s goods or services.
The registrant has no rights or legitimate interests in the domain name
Proving a negative is difficult, so panels require only that the complainant make a prima facie case (a showing strong enough to shift the burden) that the registrant lacks rights or legitimate interests. The registrant then has to come forward with evidence. Paragraph 4(c) of the policy lists three ways to do that: using the domain, or demonstrably preparing to use it, for a bona fide offering of goods or services before notice of the dispute; being commonly known by the domain name; or making a legitimate noncommercial or fair use of it without intent to mislead consumers or tarnish the mark. A reseller of genuine goods, a criticism site and a registrant whose own surname matches the domain can all have legitimate interests; a parked page of pay-per-click links that trade on the mark’s value does not.
The domain name was registered and is being used in bad faith
The third element is conjunctive. The complainant has to prove bad faith at the moment of registration and bad faith in the way the domain is being used. Paragraph 4(b) offers four non-exclusive examples: registering the name mainly to sell it to the trademark owner for more than out-of-pocket costs; registering it, as part of a pattern, to block the mark owner from reflecting its mark in a domain; registering it to disrupt a competitor’s business; or using it to attract internet users for commercial gain by creating confusion with the mark. The timing point trips up many complainants. If the domain was registered before the trademark existed, the registrant could not have targeted a mark that did not yet exist, and the case will generally fail on this element no matter how the domain is used today.
Panels do not decide these questions in a vacuum. The WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition, universally called WIPO Overview 3.0, collects the consensus positions of panelists on recurring questions under each element. It is not binding, but panels at every provider cite it, and a complaint or response that ignores it is at a disadvantage. Because there is no discovery, the evidence for all three elements has to be assembled before filing. Our step-by-step guide to filing a UDRP complaint covers what that evidence looks like, and our post on how to trademark a domain name explains how to put the first element beyond argument before a dispute ever arises.
How a UDRP proceeding unfolds
The procedure follows the UDRP Rules, which ICANN publishes, supplemented by each provider’s own rules. The sequence is the same everywhere, and we describe it in full on our page about the UDRP process from filing to decision. In outline, the complainant files a complaint setting out the domain, the registrant, the trademark, the facts behind each element, and the remedy requested. The provider sends a verification request to the registrar, which confirms the registrant’s identity and places the domain under a lock that prevents any transfer to another registrar or holder while the case is pending. That lock matters. Without it, a cybersquatter could move the domain to a new registrant the moment a complaint arrived, and the complainant would have to start over.
Once the complaint passes a formal compliance check, the provider notifies the respondent and the proceeding commences. The respondent then has 20 days to file a response. Many respondents never do, and in default cases the panel decides on the complaint and annexes alone, though it still has to be satisfied that all three elements are met. After the response period closes, the provider appoints a single panelist or, if either party has elected one, a three-member panel. The panel has 14 days from appointment to issue its decision, which the provider sends to the parties, the registrar and ICANN, and publishes.
If the panel orders a transfer or cancellation, the registrar waits ten business days before implementing it. That window lets a losing respondent sue in a court of mutual jurisdiction, meaning the location of the registrar’s principal office or of the registrant’s address, whichever the complainant elected in the complaint. If a lawsuit is filed in that window, the registrar holds the domain until the court resolves the matter; if not, it transfers the domain to the complainant. From filing to implementation, a straightforward case usually takes around two months.
What a UDRP case costs
Each provider publishes its own fee schedule, and the fee depends on two variables: the number of domain names in the complaint and the size of the panel. A single-member panel costs less than a three-member panel, and the complainant pays the full fee unless the respondent elects a three-member panel, in which case the fee is split. The provider fee is only part of the cost. Drafting the complaint, assembling the annexes and, where necessary, retaining counsel or a domain expert all add to the total.
Two documents in the public record put rough figures on this. A 2005 ICANN Security and Stability Advisory Committee report observed that a UDRP proceeding then cost approximately USD 2,000 and took at least two months to reach a decision, according to SAC007, Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions; provider fees have changed since, and that figure is a historical baseline for the filing fee alone. For the fully loaded cost to a brand owner, INTA members reported that UDRP proceedings cost an average of USD 46,152 and a median of USD 9,500 per matter in 2015 and 2016, according to the INTA New gTLD Cost Impact Survey. That survey drew on only nine responses for the UDRP cost question, and the gap between average and median shows how a few complex, multi-domain matters pull the average upward.
Remedies: transfer or cancellation, nothing more
A UDRP panel can order exactly two things. It can order the domain name transferred to the complainant, or it can order the domain name canceled. It cannot award damages, costs or attorney’s fees. Nearly every complainant asks for transfer, because cancellation simply returns the name to the available pool, where the same squatter can register it again minutes later. The absence of a damages remedy is the central trade-off of the policy. A complainant who wants compensation for lost sales or for a squatter’s profits needs a court and, in the United States, the ACPA.
When the UDRP is the wrong tool
Because the UDRP asks only whether a cybersquatter targeted a trademark, there is a large class of domain problems that it cannot solve. Recognizing them before filing saves the fee and avoids a published decision saying the complainant should have known better.
The clearest example is a stolen domain where the owner holds no trademark. Theft of a domain name is a security incident, not a trademark dispute, and if someone compromises your registrar account and moves your descriptive domain, you cannot prove the first element because you have no mark. The recovery path for a stolen domain is registrar escalation under ICANN’s Transfer Policy, including the Transfer Emergency Action Contact (TEAC) and the Transfer Undo Request Form, or TURF, followed by the Transfer Dispute Resolution Policy between registrars and, where those fail, a lawsuit for conversion. Our page on domain hijacking walks through that sequence, and our guide to the legal options for domain theft victims explains the court route.
A second example is a dispute between business partners, a company and a departed employee, or a client and a web developer who registered the domain in his own name. Those are contract and ownership disputes. The developer or partner typically registered the domain when he was authorized to do so, which defeats bad-faith registration, and panels routinely decline these cases as outside the scope of the policy. The ACPA can reach some of them. In DSPT International v. Nahum, the Ninth Circuit affirmed a USD 152,000 jury verdict against a former employee who registered his employer’s domain and withheld it to extract disputed commissions, holding that holding a domain for ransom is bad-faith use even if the original registration was innocent, according to the court’s 2010 opinion.
A third example is a registrant with a genuine legitimate interest: a company with the same name in a different industry, a reseller of the complainant’s own products, a domain investor who registered a dictionary word years before the complainant adopted it as a brand. These cases fail on the second or third element, and they are where reverse domain name hijacking findings come from.
Our comparison of the UDRP, the URS and the ACPA covers the alternatives in detail. In brief, the Uniform Rapid Suspension system (URS) is a faster, cheaper procedure limited to new gTLDs that suspends rather than transfers a domain and requires clear and convincing evidence; the Anticybersquatting Consumer Protection Act (ACPA) is the US federal statute under which a court can order transfer and award statutory damages of USD 1,000 to USD 100,000 per domain name, according to the Senate Judiciary Committee report on the Act. See also our explainer on cybersquatting, the conduct the policy was written to address, and our overview of domain name disputes for the wider family of ownership conflicts.
Reverse domain name hijacking: the risk to complainants
The UDRP Rules define reverse domain name hijacking (RDNH) as using the policy in bad faith to attempt to deprive a registered domain name holder of a domain name. A panel makes an RDNH finding when a complainant knew or should have known that it could not prove one of the elements, most often because the domain predates the complainant’s trademark, because the complainant filed only after a purchase negotiation failed, or because the complaint misrepresented the facts.
An RDNH finding carries no fine. Its cost is reputational, and it is permanent, because UDRP decisions are published and indexed. A company branded a reverse hijacker will see that finding cited against it in every future proceeding it brings and in any ACPA suit where the registrant counterclaims. The finding is reserved for complainants who treated the UDRP as a cheap way to acquire a domain rather than as a remedy for cybersquatting. We cover the topic in depth on our page about reverse domain name hijacking.
Guides in the UDRP hub
The pages below go deeper on the subjects covered here, and we add to this list as new guides are published.
- How to file a UDRP complaint covers the trademark evidence, the required contents, annexes, fees, and the mistakes that lose cases.
- UDRP vs. URS vs. ACPA compares the three dispute paths and matches each to a scenario.
- Cybersquatting explains what it is, why it is unlawful, and how to detect, stop, and prevent it.
- Is cybersquatting illegal? explains what the ACPA and the UDRP say.
- The UDRP process step by step follows a case from filing to transfer.
- Domain name disputes maps every dispute type to its forum and remedy.
- Domain name expert witness describes litigation support for attorneys.
How DNAccess uses the UDRP in domain recoveries
Most of our work involves stolen domain names, and most stolen domains are recovered through registrar escalation rather than the UDRP, for the reasons set out above. There is an important exception. When a stolen domain is also a brand, the theft and the thief’s subsequent use can satisfy all three elements, and a UDRP complaint becomes the fastest route to getting the name back, particularly when the domain has already been moved to a registrar that will not act.
Patterns.com is the example we point to. The domain was stolen from its owner’s Network Solutions account. The owner held no registered trademark, but the name had been used in commerce long enough to support common-law trademark rights, and the fraudulent transfer itself, followed by the thief’s use of the domain, was the bad faith. We built the record around both points: the evidence of secondary meaning for the first element, the absence of any legitimate interest on the thief’s part for the second, and the documentation of the account compromise and the transfer for the third. The panel ordered the domain transferred back. (The domain was later sold without its owner’s permission and remains stolen; the Patterns.com case study covers what happened after the decision.) The lesson is that a fraudulent acquisition can satisfy “registered in bad faith,” because a transfer to a new holder is treated as a new registration, and that common-law rights are enough when they are properly documented.
Beyond individual recoveries, I prepare the evidentiary record that complaints and responses depend on: forensic registration histories drawn from archived WHOIS (the public registration record for a domain name) and DNS records, timelines that fix the date a registrant actually acquired a domain, and analysis of how the domain has been used. In litigation that runs alongside or after a UDRP case, I have testified as an expert witness on domain registration practices and on what the historical records show. The records that win a UDRP case are the ones that survive cross-examination in court, so we build them the same way for both.
If a domain that matters to your business has been taken by a cybersquatter, stolen out of a registrar account or claimed by someone with a competing story, we can tell you after a short review which route fits your facts. Our stolen domain name recovery service covers the registrar, UDRP and litigation paths, and you can contact us to start that review.