What is the UDRP procedure? A complete guide to protecting your domain names
Introduction
A domain name is now an essential asset of a company’s digital identity. Its registration by a third party may create significant risks when it is used to divert Internet users, unlawfully exploit a trademark, organise phishing operations or create a fake online store.
In this context, the Uniform Domain Name Dispute Resolution Policy (UDRP) is one of the main mechanisms enabling trademark owners to recover certain abusively registered domain names.
Its importance remains considerable: in 2025, the WIPO Arbitration and Mediation Center administered 6,282 domain name disputes, the highest annual level since the system was created. More than 80,000 cases have now been handled since its launch.
The procedure nevertheless remains subject to specific conditions. The mere reproduction of a trademark in a domain name is not automatically sufficient to obtain its transfer or the cancellation of the domain name.
Understanding the UDRP procedure and its scope
The UDRP procedure was adopted by ICANN in 1999 in order to provide a specialised out-of-court mechanism against certain abusive domain name registrations.
It applies in particular to the main generic extensions such as .com, .net or .org, as well as to certain ccTLDs that have chosen to adopt it.
Its main purpose is to deal quickly with situations of cybersquatting, namely cases in which a third party abusively registers or uses a domain name corresponding or similar to a trademark belonging to another party.
The procedure does not, however, replace court proceedings. It is a specialised mechanism whose purpose concerns the fate of the disputed domain name.
For country-code extensions, some apply the UDRP directly, while others have established their own dispute resolution procedure or an adaptation of the UDRP. These local mechanisms may differ significantly as regards the criteria to be established, the rights that may be invoked, the way bad faith is assessed, the time limits, costs, or the remedies that may be ordered.
For example, .fr domain names notably fall under the SYRELI and PARL EXPERT procedures administered within the AFNIC framework, while disputes concerning .uk domain names are subject to the Dispute Resolution Service (DRS). .eu domain names also have a specific ADR procedure. It is therefore essential, before taking any action, to verify the policy applicable to the extension concerned rather than automatically transposing the UDRP criteria.
The three conditions to establish in order to obtain the transfer of a domain name
The UDRP requires the complainant to establish three cumulative conditions. They are set out in paragraph 4(a) of the ICANN Policy.
A domain name identical or similar to a trademark
The complainant must first demonstrate that it has rights in a trademark and that the disputed domain name is identical or confusingly similar to that trademark.
The addition of a descriptive, geographical or commercial term is generally insufficient to eliminate similarity where the trademark remains clearly identifiable in the domain name.
Cases of typosquatting, based on a typographical error or a slight spelling variation, may also satisfy this first requirement.
The absence of rights or legitimate interests on the part of the registrant
The complainant must then establish that the registrant has no rights or legitimate interests in the domain name.
The analysis may notably focus on the existence of:
- a genuine commercial activity conducted in good faith;
- a legitimate non-commercial use;
- a name by which the registrant is commonly known;
- or, conversely, use intended to benefit from the reputation of a third party’s sign.
In practice, the complainant must generally submit sufficient evidence to establish prima facie the absence of rights or legitimate interests. It is then for the respondent, if it is able to do so, to provide a contrary justification.
Registration and use in bad faith
Finally, the domain name must have been registered and used in bad faith.
The UDRP Policy gives several examples, including registration primarily for the purpose of selling the domain name to the trademark owner, registration intended to prevent the trademark owner from using its sign in a domain name, or use intended to attract Internet users for commercial gain by creating an association with the trademark.
Other circumstances may also be relevant: a fake online store, phishing, impersonation, redirection to a competitor, an offer to sell the domain name, a pattern of similar registrations, or the use of clearly inaccurate identification information.
The absence of an active website does not necessarily exclude bad faith. Under the doctrine known as passive holding, the inactivity of the domain name may be considered together with all the circumstances, including the distinctiveness of the trademark, the absence of a credible explanation, or the impossibility of envisaging a good-faith use.
Preparing a UDRP complaint effectively
It is recommended to preserve :
- certificates or extracts demonstrating trademark rights;
- available data relating to the registration of the domain name;
- dated screenshots of the website;
- observed redirects;
- emails associated with the domain name, where relevant;
- offers for sale or correspondence with the registrant;
- evidence demonstrating imitation, phishing or data collection;
- the history of the domain name where this provides useful context.
Regular domain name monitoring makes it possible in particular to identify quickly registrations that may justify action.
It is also important not to overinterpret the use of a privacy service. Such use does not, by itself, establish bad faith. However, where it appears to have been used deliberately to conceal the registrant’s identity in an already abusive context, it may constitute an additional factor to be taken into account.
How the UDRP procedure works
The complaint is filed with an approved service provider, such as the WIPO Arbitration and Mediation Center.
Following verification with the registrar, the domain name is placed under lock during the proceedings in order to prevent it from being transferred to a third party. The ICANN UDRP Rules provide that the registrar transmits the registration data to the provider and confirms the lock.
The respondent then has, in principle, 20 days from the formal commencement of the proceedings to submit its response with the possibility of obtaining an automatic four-day extension upon request.
One point must be clearly emphasised: the absence of a response from the respondent does not mean that the complainant automatically wins. The panel must always verify that the three UDRP requirements are established. It may nevertheless draw certain consequences from the absence of an explanation where a particular matter clearly calls for a response.
The case is then examined by a panel composed of one or three experts. Except in exceptional circumstances, the decision is transmitted within 14 days following the appointment of the panel.
For cases administered by WIPO, the standard fee for a complaint concerning one to five domain names and decided by a single-member panel is currently USD 1,500. Since 2026, WIPO has also offered an expedited case processing service aimed at obtaining a decision in approximately one month for certain eligible cases.
Possible decisions and the limits of the procedure
The panel may principally:
- order the transfer of the domain name;
- order its cancellation;
- or reject the complaint.
The UDRP does not allow the complainant to obtain damages or reimbursement of legal fees.
Where a transfer or cancellation is ordered, the registrar normally implements the decision after a period of 10 business days, unless the respondent provides evidence that it has commenced proceedings before a competent court.
This possibility highlights an essential limitation: the UDRPdoes not prevent the matter from being brought before the courts.
. Court proceedings may be preferable where it is necessary to obtain compensation, measures concerning several types of conduct, or a legal assessment going beyond the domain name alone.
Integrating the UDRP into an overall domain name protection strategy
The UDRP should not be viewed as an isolated reaction after the discovery of a disputed domain name.
An effective strategy may combine:
- defensive registrations under priority extensions;
- automated monitoring of new registrations;
- rapid risk assessment;
- systematic preservation of evidence;
- notices to registrars or hosting providers where the circumstances justify it;
- negotiation of an amicable transfer;
- a UDRP proceeding or local mechanism;
- court proceedings in the most sensitive cases.
The choice depends on the use observed, the urgency, the identity of the registrant, the strategic value of the domain name and the outcome sought.
Conclusion
The UDRP procedure is a rapid and specialised tool for combating certain abusive domain name registrations, but its effectiveness depends on a rigorous demonstration of the three criteria imposed by the Policy.
The presence of a trademark in the domain name is therefore only a starting point. It is also necessary to examine any rights or legitimate interests of the registrant, the chronology of the registration and the indicators of bad faith.
Early preservation of evidence and the integration of the UDRP into an overall strategy for monitoring and protecting digital assets make it possible to act more effectively against cybersquatting.
Dreyfus Law Firm assists its clients in managing complex intellectual property matters, offering personalised advice and comprehensive operational support for the complete protection of intellectual property.
Nathalie Dreyfus, with the support of the entire Dreyfus team.
Q&A
Can a UDRP proceeding be initiated where the domain name was registered before the trademark was acquired?The chronology plays a decisive role. Where a domain name predates the trademark rights relied upon, establishing registration in bad faith may become particularly difficult.
Can a domain name used only for email addresses be recovered?The absence of an active website does not necessarily exclude a UDRP proceeding. The existence of email servers, particularly in a context involving phishing or impersonation, may constitute an important factor in the analysis.
What happens if the registrant changes after the initial registration of the domain name?A change of registrant may, in certain circumstances, be treated as a new registration for the purposes of assessing bad faith. The assessment is therefore made as of the date on which the new holder acquired the domain name, rather than the date of its initial registration. Conversely, a mere renewal or an administrative change to the contact details does not, in principle, constitute a new registration.
Is a UDRP proceeding appropriate where the dispute arises from a former commercial relationship between the parties?This type of dispute may go beyond the scope of traditional cybersquatting where it primarily arises from a contract, partnership or former distribution relationship. Proceedings before national courts may then be more appropriate.
Does a trademark owner face any risk if it files an insufficiently substantiated UDRP complaint?A panel may make a finding of Reverse Domain Name Hijacking if it considers that the procedure was used abusively in an attempt to obtain a domain name to which the complainant knew, or ought to have known, it was not entitled.
This publication is intended for general public guidance and to highlight issues. It is not intended to apply to specific circumstances or to constitute legal advice.