The UDRP process is a fixed sequence of administrative steps that runs from the day a trademark owner files a complaint to the day the registrar moves the domain name into the complainant’s account. The UDRP (Uniform Domain-Name Dispute-Resolution Policy) is the ICANN procedure every registrar of a generic top-level domain must follow, and its Rules set a deadline for nearly every stage. That is what makes the UDRP timeline predictable: Forum cases averaged 32 days from commencement to decision between 2013 and 2020, according to the GNSO’s revised UDRP status report. This page walks through each stage in order and explains what each party does. For the policy itself and the three elements, start with our complete guide to the UDRP.
Pre-filing preparation
The procedure formally begins with a filing, but the outcome is usually decided before that. A complainant needs proof of trademark rights, evidence about the respondent and the domain’s use, and a clear theory of bad faith. A domain name background check reconstructs the registration history, prior WHOIS records (WHOIS being the public registration record for a domain name), historical DNS, archived page content and any sale listings, which together show when the respondent acquired the name and what it has been used for since. The complaint document itself is covered in our guide to filing a UDRP complaint.
Filing and the fee
The complainant submits the complaint and its annexes to an ICANN-approved provider, most often WIPO (the World Intellectual Property Organization) or Forum, and pays the fee in the provider’s published schedule. The fee depends on the number of domain names and on panel size, and the complainant pays all of it unless the respondent later elects a three-member panel, in which case the respondent pays half. Nothing moves until payment clears. Filing volume is high: WIPO alone received 6,282 UDRP-based complaints in 2025, the largest number in its history, according to the WIPO Secretariat’s update to the Standing Committee on the Law of Trademarks.
Registrar verification and the lock
The provider sends a verification request to the registrar of record, and the registrar has two business days to confirm that the domain is registered with it, who the registrant is according to its own records (including the identity behind any privacy or proxy service), the language of the registration agreement and the registrant’s contact details. At the same time the registrar must lock the domain name. The lock is a registrar-level hold that blocks any transfer to another registrar and any change to the registrant of record until the proceeding ends. The lock matters because, without it, a respondent who received notice could move the domain to a new registrar or registrant, a tactic known as cyberflight. The lock does not take the website offline; it freezes ownership so that whoever wins can actually receive the domain. The verification response also fixes the respondent’s identity, which is why a complaint filed against a privacy service is usually amended once the underlying registrant is revealed.
Compliance review and the deficiency window
The provider then checks the complaint against the formal requirements of the Rules: the required certifications, the mutual jurisdiction, the remedy requested, the word limits, the fee and a respondent name that matches the registrar’s verification. If anything is missing, the provider issues a notice of deficiency and the complainant has five calendar days to cure it. A complaint not corrected within that window is deemed withdrawn, although it can be refiled. In the cases we support, the most common deficiency is a respondent name that does not match the registrar’s records.
Notification and commencement
When the complaint passes review, the provider formally notifies the respondent at every address the registrar supplied, including the postal address, the email addresses in the registration record and the postmaster address at the domain. The date of that notification is the date of commencement, and every later deadline counts from it.
The 20-day response period
The respondent has 20 calendar days from commencement to file a response. A response answers each allegation, sets out the respondent’s rights or legitimate interests in the name and explains why the registration and use were not in bad faith. The strongest responses are documented: evidence of a genuine business using the name before notice of the dispute, proof that the name is a dictionary word registered for its ordinary meaning, or proof that the domain was acquired before the complainant’s mark existed. The response also states whether the respondent elects a three-member panel. Extensions are possible, but short.
Default cases
Many respondents never answer. When the deadline passes, the provider notifies both parties of the default and proceeds to appoint a panel. A default is not an automatic win; the panel still has to find that all three elements are proven, and panels do deny defaulted complaints when the evidence is thin. In practice, though, the panel may draw reasonable inferences from silence, which helps explain why the complainant obtained the domain in about 78% of UDRP cases across all providers between 2013 and 2020, as reported in the same ICANN GNSO status report.
Panel appointment
Panelists are independent practitioners, usually trademark attorneys, drawn from the provider’s published list. For a single-member panel, the provider selects the panelist, aiming to appoint within five calendar days of the response deadline. For a three-member panel, each party supplies three preferred candidates, the provider tries to appoint one from each list, and the presiding panelist is chosen from five candidates that both parties rank. Every panelist signs a declaration of impartiality and independence and must disclose anything that could raise justifiable doubt about either; a panelist with a conflict is replaced. A three-member panel takes longer to assemble, which is the main reason those cases run past the average.
The 14-day decision and publication
The panel must forward its decision to the provider within 14 calendar days of appointment. It decides on the written record alone: no hearing, no witnesses, no discovery. The decision orders transfer, cancellation or denial, and where the complaint was brought in bad faith to deprive a registrant of a domain, the panel can declare reverse domain name hijacking. The provider communicates the full decision to the parties, the registrar and ICANN within three business days and publishes it. Published decisions are searchable, so a respondent who has lost before will be found by the next complainant.
The 10-business-day implementation window
If the panel orders transfer or cancellation, the registrar must wait ten business days after being informed of the decision before acting. The waiting period exists to give the losing respondent time to sue in the mutual jurisdiction named in the complaint, which is either the location of the registrar’s principal office or the respondent’s address in the registration record. If the registrar receives official documentation showing that the respondent has sued the complainant in that jurisdiction within the window, it takes no further action until it receives evidence of a settlement, a dismissal or a court order resolving ownership. A court filing therefore pauses the UDRP remedy entirely, and the court decides the case fresh under national law. How the UDRP compares with those court remedies, and with the faster URS, is covered in our comparison of UDRP, URS and ACPA.
Implementation by the registrar
When the ten business days pass without a court filing, the registrar implements the decision. For a transfer, the registrar moves the domain into an account controlled by the complainant, usually at the same registrar. For a cancellation, the registrar deletes the registration, which returns the name to the available pool; most complainants request transfer instead, because a canceled name can be re-registered by anyone, including the same respondent.
What happens after the transfer
Winning the decision is not the same as securing the domain. The receiving account should be hardened with multi-factor authentication, the registrar’s transfer lock should be enabled and, for a name that matters to the business, a registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) should be added. DNS should be reviewed and any mail the former registrant configured should be removed.
The UDRP timeline at a glance
| Stage | Who acts | Typical timing |
|---|---|---|
| Pre-filing preparation | Complainant and counsel | Days to weeks, depending on evidence |
| Filing and fee payment | Complainant | Day 0 |
| Registrar verification and lock | Provider requests; registrar responds and locks | Within 2 business days of the request |
| Compliance review and deficiency cure | Provider reviews; complainant cures | Up to 5 calendar days to cure |
| Notification and commencement | Provider | Promptly after review |
| Response period | Respondent | 20 calendar days from commencement |
| Panel appointment | Provider, with party input for three-member panels | Targeted within 5 days of the response deadline |
| Decision | Panel | Within 14 calendar days of appointment |
| Publication | Provider | Within 3 business days of the decision |
| Implementation window | Registrar waits; respondent may sue | 10 business days |
| Transfer or cancellation | Registrar | After the window closes |
Together, a contested single-member case typically runs about two months from filing to transfer, consistent with the observation in ICANN’s 2005 SSAC hijacking report that a UDRP proceeding takes “at least two months” to reach a decision, as recorded in SAC007, Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions. That dated report drew a conclusion we repeat to clients often: a two-month procedure built around trademark rights is the wrong tool for a domain that was stolen yesterday. Our page on the types of domain name disputes maps each one to its proper forum.
How DNAccess supports clients through the UDRP process
We prepare the evidentiary foundation a UDRP complaint stands on: the registration history, WHOIS and DNS records, archived content and sale listings that prove when a respondent acquired a name and how it has been used. We work alongside trademark counsel from filing through implementation, and when a domain was taken by theft rather than cybersquatting we redirect the matter to our stolen domain name recovery service, where registrar escalation and the transfer dispute procedures work faster than any panel. If you are weighing a UDRP filing or have received one, contact us before the clock starts.