You Received a UDRP Complaint: How to Keep Your Domain

An email arrives from the WIPO Arbitration and Mediation Center or from Forum: a company claims your domain name infringes its trademark and has filed a UDRP complaint demanding the domain be transferred to it. Maybe you run a real business on that domain. Maybe you registered it years before this company existed. Either way, the notice is jargon-dense and the deadline is real, so here is what is actually happening: what the UDRP is, the three things the complainant must prove, how to respond within the 20-day window, and what happens after the decision, in both directions.

What a UDRP complaint actually is (and is not)

The Uniform Domain-Name Dispute-Resolution Policy is an ICANN policy incorporated by reference into every gTLD domain registration agreement. When you registered the domain, you agreed to submit to this process if a trademark owner invoked it. The policy text lives at ICANN, and cases are administered by approved providers, principally the WIPO Arbitration and Mediation Center and Forum (formerly the National Arbitration Forum), each with its own supplemental rules.

What it is not:

• A lawsuit. No court is involved. The decision-maker is a panel of one or three trademark practitioners.
• A damages proceeding. The panel can order exactly three outcomes: transfer the domain to the complainant, cancel it, or deny the complaint. Nobody pays anybody damages.
• The end of the road. Either party can still go to court afterward; the UDRP decision does not bind a judge.

It was designed as a fast, cheap remedy against clear cybersquatting, the practice covered in what is cybersquatting. That design has a defense-side implication worth internalizing early: the UDRP is deliberately narrow, and panels regularly deny complaints against respondents with genuine businesses or genuinely earlier rights. You are not presumed to be a squatter.

The three elements: the complainant must prove all of them

Under paragraph 4(a) of the Policy, the complainant must establish every one of the following, per WIPO’s official guide:

1. The domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights. This is usually the easiest element for complainants; panels compare the domain to the mark directly, and adding a word or a typo rarely avoids similarity.
2. You have no rights or legitimate interests in the domain. This is where respondents with real stories win. The complainant must make at least an initial showing that you lack any legitimate basis, and your response is where you rebut it.
3. The domain was registered AND is being used in bad faith. The conjunction is load-bearing. Both bad-faith registration and bad-faith use are required, which is why timing is often the whole case: if you registered the domain before the complainant had any trademark rights, you logically could not have registered it in bad faith targeting a mark that did not yet exist. Policy 4(b) lists the classic bad-faith patterns: registering primarily to sell the domain to the mark owner at a markup, a pattern of registering domains to block mark owners, registering to disrupt a competitor, or using the domain to attract traffic through confusion for commercial gain.

Fail any single element and the complaint fails. Structure your response element by element, and put your strongest element first in your own mind: for most legitimate registrants, that is element two or the registration-timing half of element three.

Your deadline: 20 days from commencement

Under the UDRP Rules, you have 20 days from the commencement of the proceeding to submit your response. Commencement is the date the provider formally notifies you that the complaint passed its formalities check, not the date you first heard a complaint might be coming. WIPO’s guide confirms respondents can request an automatic four-day extension, and providers may grant further extensions in limited circumstances or by agreement.

If you file nothing, the panel decides on the complaint alone and may draw appropriate inferences from your default. Panels still require the complainant to prove its three elements, but in practice defaulting respondents lose the overwhelming majority of cases. Twenty days is tight but workable; the response below is a document, not a trial.

How to build your response

Format and length. The response is a written submission addressing the three elements, with annexes of evidence. Word limits come from each provider’s supplemental rules: WIPO’s Supplemental Rules cap the response argument at 5,000 words (the complaint is capped the same), so this is a focused brief, not a filing cabinet. Check your provider’s own rules, because limits and formatting differ between WIPO and Forum.

Evidence wins UDRP cases. Panels decide on the papers, with no hearings or discovery, so documents do the talking: your business records showing when and why you registered the domain, archived screenshots of what the site has actually hosted over the years (the Wayback Machine is standard evidence), incorporation papers or licenses if you are commonly known by the name, and correspondence showing the complainant knew of and tolerated your use.

Panel selection and fees. The complainant chooses a single-member or three-member panel when filing; at WIPO the fee is currently $1,500 for a single-member panel and $4,000 for a three-member panel covering one to five domains, per WIPO’s fee schedule. Here is the respondent’s lever: even if the complainant chose a single panelist, you may elect a three-member panel. Each party then nominates candidates, and per WIPO’s guide the applicable three-member fee is shared equally, so your half is $2,000, paid with your response. Respondents with strong cases sometimes elect three members for a broader look and to signal they are contesting seriously; respondents watching costs typically stay with the single panelist and pay no provider fee at all.

The defenses that actually win

Paragraph 4(c) of the Policy gives you three non-exclusive safe harbors, any one of which establishes rights or legitimate interests and defeats element two:

1. Bona fide offering before notice. Before you had any notice of the dispute, you used the domain (or made demonstrable preparations to use it) in connection with a genuine offering of goods or services. A real store, a real service, a real project, documented, is the classic winning response.
2. Commonly known by the name. You, your business, or your organization has been commonly known by the domain name, even without a trademark registration. Surnames, long-standing nicknames, and legacy business names all fit here.
3. Legitimate noncommercial or fair use. You are making legitimate noncommercial or fair use of the domain, without intent for commercial gain, to misleadingly divert consumers, or to tarnish the mark. Genuine criticism sites and fan sites live in this harbor, with panel views varying on the details.

Layered on top of these is the timing defense discussed above: registration predating the complainant’s trademark rights generally defeats bad-faith registration outright. And note what is missing from your burden: you do not have to own a trademark, and you do not have to prove the complainant is wrong about similarity. One dispositive defense is enough.

Reverse domain name hijacking: when the complaint itself is the abuse

Some UDRP complaints are filed by parties who know they cannot win, hoping the respondent defaults or folds. The Rules have a name for this: reverse domain name hijacking, defined as using the Policy in bad faith to attempt to deprive a registrant of its domain. Under Rule 15(e), if the panel finds the complaint was brought in bad faith, it “shall declare” that the complaint constitutes an abuse of the administrative proceeding. An RDNH finding carries no fine, but it is a public, citable rebuke that follows the complainant into any later proceeding, and asking for one, where the facts support it, sharpens a strong response. Common RDNH fact patterns: the complainant’s mark postdates your registration and it knew so, or the complaint followed failed purchase negotiations.

What happens after the decision

If you win, the complaint is denied and you keep the domain. The complainant could still sue in court, but a reasoned UDRP denial makes that less attractive.

If you lose, the panel orders transfer (or, rarely, cancellation), and the registrar must implement the decision ten business days after being notified of it. Paragraph 4(k) of the Policy builds in your escape hatch: if within those ten business days you provide the registrar with official documentation showing you filed a lawsuit against the complainant in a jurisdiction identified in the complaint (typically where the registrar or you are located), the registrar takes no further action until the court case resolves. In U.S. courts that suit is typically a declaratory action under the Anticybersquatting Consumer Protection Act framework, 15 U.S.C. § 1125(d), asking the court to declare your registration lawful. Courts review the dispute fresh; the UDRP decision does not bind them. Calendar those ten business days the moment an adverse decision arrives, because the window is unforgiving.

Two adjacent tracks are worth knowing. The URS (Uniform Rapid Suspension) is a faster, cheaper cousin used mostly for newer gTLDs; it can only suspend a domain, not transfer it, and has a higher proof standard. And the ACPA is the federal-court alternative complainants sometimes choose from the start, where damages are on the table. The full comparison lives in UDRP vs. URS vs. ACPA. For the complainant’s-eye view of this same proceeding, see how to recover a domain name. Real dispute outcomes are collected in the domain-name case archive.

The bottom line

A UDRP complaint is a narrow, fast arbitration over one asset, with the burden on the complainant to prove all three 4(a) elements: confusing similarity, your lack of legitimate interests, and bad-faith registration and use. Calendar the 20-day response deadline immediately, take the automatic four-day extension if needed, and build a documented, element-by-element response around your strongest ground: a bona fide business before notice, being commonly known by the name, legitimate noncommercial use, or a registration that predates the complainant’s rights entirely. Decide deliberately whether a three-member panel is worth your $2,000 share, ask for a reverse-domain-name-hijacking finding if the complaint deserves one, and know that even a loss is not final: 4(k) gives you ten business days to take the fight to court. For the broader map of domains, trademarks, and squatting disputes, start at the domain names and cybersquatting hub, and if your dispute involves lookalike or typo domains, see typosquatting and brand domains.

This guide is for educational purposes only and is not legal advice. IP outcomes turn on specific facts; talk to a licensed attorney about your situation.