Domain Name and Digital Identity Toolkit: gTLDs, the Clearinghouse, and Recovery

By Casey Scott McKay · 2026-06-15

A brand's digital identity spans domains, handles, app listings, and on-chain names, and only one of those layers has a real dispute system. This toolkit maps all of them: the UDRP and URS that resolve domain disputes by contract, the ACPA that supplies money and an in rem route when the registrant cannot be found, the Trademark Clearinghouse and sunrise mechanisms that prevent problems in new top-level domains, and the far weaker recovery paths for social handles and blockchain naming records. It covers portfolio hygiene - registrar consolidation, locks, role-based contacts, and renewal discipline - because the most common way a company loses a domain is not theft but expiration. It treats the defensive side seriously, including reverse domain name hijacking, and it closes with a cost map, an authorities table, and the forms that paper each step.

IP and Technology > Internet | Toolkit | Published 15 June 2026 - Updated 30 June 2026 | Casey Scott McKay - marksy.us

Summary. A brand's digital identity spans domains, handles, app listings, and on-chain names, and only one of those layers has a real dispute system. This toolkit maps all of them: the UDRP and URS that resolve domain disputes by contract, the ACPA that supplies money and an in rem route when the registrant cannot be found, the Trademark Clearinghouse and sunrise mechanisms that prevent problems in new top-level domains, and the far weaker recovery paths for social handles and blockchain naming records. It covers portfolio hygiene — registrar consolidation, locks, role-based contacts, and renewal discipline — because the most common way a company loses a domain is not theft but expiration. It treats the defensive side seriously, including reverse domain name hijacking, and it closes with a cost map, an authorities table, and the forms that paper each step.

Keywords: udrp · urs · acpa · cybersquatting · in rem · typosquatting · trademark clearinghouse · sunrise registration · claims notice · defensive registration · registrar lock · domain portfolio · whois · privacy proxy · cctld · reverse domain name hijacking · social handles · blockchain names · domain recovery · registrar transfer

Start Here

Onwuka Delacroix-Byrne manages brand protection for a home goods company. In one week five things happen to its digital identity, and only two of them have a good remedy.

A typosquatted domain — one letter transposed — is serving pay-per-click links to competitors, with the registrant masked behind a privacy service.

A new top-level domain launches in the company's category, and someone has registered the company's exact mark in it.

The company's own primary domain nearly lapses, because auto-renew was tied to a card that expired and the registrar's notices went to a former employee's address.

A dormant social handle matching the brand has been held since 2015 by someone unconnected to the company, who now wants a five-figure payment.

And a blockchain naming record matching the brand has been registered by a stranger, transferable and beyond any registry's power to reassign.

Two of these have a fast, cheap, well-governed remedy. Two have essentially none. And one — the near-lapse — was the most dangerous of all and was entirely self-inflicted.

This toolkit answers three questions.

Which layer is this, and what dispute system governs it? The answer ranges from a mature international policy to nothing at all.
What is the cheapest instrument that gets the outcome? Suspension, transfer, money, or a negotiated purchase.
What prevents this? Because prevention in this area is unusually cheap and unusually effective.

If you read only one thing, read After .com. It explains the Clearinghouse and sunrise mechanisms, which are the prevention layer that makes the rest of this toolkit mostly unnecessary.

Part One: The Domain Layer, Which Actually Works

Domains are the best-governed part of digital identity, because every registrant of a generic top-level domain agreed by contract, at registration, to submit to a dispute policy.

The UDRP

What it is. A contractual dispute policy administered by approved providers, applicable to all generic top-level domains and adopted voluntarily by many country-code registries.

The three elements, all required. The domain is identical or confusingly similar to a mark in which the complainant has rights; the registrant has no rights or legitimate interests in it; and it was registered and is being used in bad faith. The conjunctive requirement in the third element is where many complaints fail — a domain registered innocently and later used badly frequently does not satisfy it.

Rights required. Registered or common law. Unlike some mechanisms, the UDRP recognizes unregistered rights, though proving them adds work.

Remedy. Transfer or cancellation. No money, no injunction, no findings that bind anywhere else.

Timeline. Roughly sixty days from filing to decision, with a short implementation window after.

Cost. A provider fee plus preparation. Very cheap relative to any court.

Defenses that succeed. A legitimate noncommercial or fair use. A bona fide offering of goods before notice of the dispute, including the reseller cases. Being commonly known by the name. And criticism sites, which panels treat variably but frequently protect.

See UDRP Complaint Checklist; Filing a UDRP Complaint; Responding to a UDRP Complaint; UDRP vs. Federal Lawsuit.

The URS

What it is. A faster, cheaper, narrower mechanism applicable to new generic top-level domains and some others.

The differences that matter. A higher standard of proof — clear and convincing evidence. A registered, court-validated, or treaty-protected mark in current use, not common law rights. A remedy limited to suspension for the balance of the registration term, not transfer. A short response window. And a decision in weeks rather than months.

When to use it. An obvious infringement in a new top-level domain where suspension is enough and speed matters. Not where you want the domain.

The ACPA

What it is. A federal cause of action at 15 U.S.C. § 1125(d) for registering, trafficking in, or using a domain that is identical or confusingly similar to a distinctive mark, or dilutive of a famous mark, with a bad-faith intent to profit. Nine non-exclusive bad-faith factors guide the analysis.

What it delivers that the UDRP does not. Money — statutory damages of a defined range per domain under 15 U.S.C. § 1117(d), elected any time before final judgment, or actual damages and profits. Injunctive relief. And a judgment that deters.

The in rem route. Where personal jurisdiction over the registrant is unavailable, 15 U.S.C. § 1125(d)(2) permits an action against the domain name itself in the judicial district where the registrar or registry is located, with the remedy limited to forfeiture, cancellation, or transfer. This is the answer for the anonymous overseas registrant behind a privacy service.

The personal-name provision. 15 U.S.C. § 8131 provides a cause of action for registering the personal name of a living individual with intent to profit by selling it, with injunctive relief and fees but no statutory damages.

Registrar protections. 15 U.S.C. § 1114(2)(D) immunizes registrars for good-faith transfers and suspensions, and creates a cause of action for a registrant wrongly dispossessed.

See Cybersquatting and the ACPA; UDRP vs. Lawsuit: Recovering an Infringing Domain.

Part One-and-a-half: Winning the Bad-Faith Element

Most UDRP complaints that fail, fail on the third element, so it deserves its own treatment.

The conjunctive problem. The policy requires bad faith at registration and in use. A domain registered years before the complainant's mark existed cannot have been registered in bad faith, however badly it is used today. Establish the timeline first: the complainant's rights must predate the registration, and where they do not, the complaint is usually unwinnable regardless of the current use.

Renewal is generally not a new registration for this purpose in the UDRP context, which forecloses the argument that a long-held domain became bad-faith when the holder renewed it after learning of a mark. Under the ACPA, courts have similarly held that renewal by the original registrant is not a new registration. A transfer to a new holder, by contrast, generally is treated as a new registration and resets the analysis — which is why the chain of registrants matters and why historical registration data is worth capturing.

The evidence that establishes bad faith.

An offer to sell to the complainant or a competitor for more than out-of-pocket costs. Capture it in full.
A pattern of registrations targeting multiple brands. This is the single most persuasive category, and it requires searching what else the registrant holds and what else sits on the same nameservers.
Disruption of a competitor's business, where the registrant is a competitor.
Attracting users for commercial gain through likelihood of confusion, which covers most pay-per-click parking.
Concealment of identity through a privacy service combined with other factors — not bad faith by itself, since privacy services have legitimate uses, but corroborative.
False registration data, which is a stronger version of the same point.
Passive holding in narrow circumstances, where the mark is well known, the registrant has no plausible use, and the other indicia are present.

The evidence that defeats it. Use predating any notice of the dispute for a genuine offering. A descriptive term used descriptively. A personal name or nickname. A criticism site with no commercial purpose. And a reseller offering the complainant's actual goods with accurate disclosure of the relationship.

Plead the timeline explicitly. A complaint that opens with the complainant's first-use and registration dates, then the domain's creation date and registrant history, has framed the element before arguing it. A complaint that buries the dates invites a panel to construct the timeline itself, and panels that do so frequently find a gap.

Part Two: Choosing Among Them

| | URS | UDRP | ACPA | |---|---|---|---| | Applies to | New gTLDs and opted-in registries | All gTLDs, many ccTLDs | Any domain reachable by U.S. jurisdiction, plus in rem | | Rights required | Registered, validated, or treaty-protected, in use | Registered or common law | Distinctive or famous at registration | | Standard | Clear and convincing | Preponderance | Preponderance | | Remedy | Suspension for the term | Transfer or cancellation | Transfer, injunction, damages or statutory damages, fees | | Response window | Short | Twenty days, extendable | Rule 12 clock | | Time to outcome | 2–4 weeks | About 60 days | 12–24 months | | Relative cost | Very low | Low | High |

The decision rule. Use the URS to turn something off fast. Use the UDRP to get the domain. Use the ACPA when you need money, deterrence, or reach over a registrant a panel cannot touch — and use the in rem route when nobody can be found.

And consider buying it. For a domain held by someone with a colorable claim, or where the UDRP's bad-faith element is genuinely doubtful, a negotiated purchase is frequently cheaper and faster than any proceeding. Use an escrow, condition payment on completed transfer at the registrar, and take a covenant against re-registering variants.

Part Three: Prevention

Everything above is remedial and expensive relative to prevention, which is cheap and works.

The Trademark Clearinghouse. A central repository of verified marks that unlocks two mechanisms in new top-level domains: sunrise registration, permitting rights holders to register before general availability; and the claims service, which notifies a would-be registrant that a matching mark exists and notifies the rights holder if registration proceeds. Recording is inexpensive and it is the single highest-return preventive step in this area.

Understand what the Clearinghouse is not. It is notice and priority access, not enforcement. A claims notice does not stop anyone; it tells you what happened.

Defensive registration, budgeted rather than reflexive. Registering every variant in every top-level domain is impossible and pointless. Register: the exact match in the top-level domains that matter commercially; the obvious typographical variants for the primary domain; the common misspellings; and the marks in any top-level domain closely associated with the category.

Blocking services offered by some registry operators cover a mark across a portfolio of top-level domains for a single fee, and for a brand facing broad exposure they are usually better value than individual registrations.

Monitoring. A watch service covering new registrations matching or approximating the marks, across generic and relevant country-code domains, read by someone whose job includes reading it.

See Building a Domain Name Portfolio and Enforcement Program.

Part Four: Portfolio Hygiene, Where Losses Actually Happen

The most common way a company loses a domain is not a dispute. It is administrative failure.

Consolidate registrars. Domains scattered across five registrars, some registered by agencies and developers, is the normal state and it is the underlying problem.

Register in the entity's name, with role-based administrative and technical contacts on a company domain — and here is the trap: if the contact email is hosted on the domain itself, a lapse takes the recovery channel with it. Use a secondary domain or an external address for registrar contacts.

Enable registrar lock and, for critical domains, registry lock. Registry lock requires an out-of-band verification for any change and is the strongest available protection against unauthorized transfer.

Enable auto-renew, and verify the payment method annually. An expired card is the most common cause of a lapse.

Register for longer terms on critical domains, which reduces the number of renewal events that can fail.

Enable two-factor authentication on registrar accounts, with recovery held corporately.

Maintain a register. Every domain, registrar, registrant of record, contacts, expiry, lock status, auto-renew status, and what it points to. Reconcile annually.

Understand the grace periods. Expired domains typically pass through renewal and redemption periods before deletion, with escalating fees; recovery in redemption is possible and expensive, and after deletion the domain may be caught by a drop-catching service within seconds.

And treat DNS as part of the asset. Control of the nameservers is control of the domain in practice, and DNS provider accounts deserve the same governance as registrar accounts.

See Domain Portfolio Checklist.

Part Four-and-a-half: The Incident Playbook

When a domain is lost or compromised, the first hours matter more than in almost any other brand emergency, because a domain controls email, authentication, and often the recovery path for everything else.

If a domain lapsed. Determine which grace period it is in. Renewal during the initial grace period is routine; redemption is expensive but available; after deletion the domain is gone and may be caught within seconds by a drop-catching service. Act the same day, and escalate to the registrar by phone rather than by ticket.

If a domain was transferred without authorization. Contact the losing registrar immediately and invoke the transfer dispute process, which has short deadlines. Simultaneously, secure every other domain in the portfolio, because an unauthorized transfer usually means the registrar account was compromised rather than the domain targeted individually. Rotate credentials, revoke sessions, and enable registry lock on what remains.

If DNS was hijacked. The domain may still be registered to you while the nameservers point elsewhere, which is faster to fix and equally damaging while it lasts. Check the registrar record first; if it is intact, the problem is the DNS provider account.

If email is affected, assume everything is affected. Password resets for the registrar, the platforms, the payment processors, and the banking relationships all run through email. An email domain compromise is a full-portfolio incident.

Preserve as you go. Registrar logs, DNS change records, email headers, and screenshots of the resolving site. If the matter becomes an ACPA action or a criminal referral, this is the record.

Then fix the cause. Almost every incident of this kind traces to one of four things: an unlocked domain, a shared or weak registrar credential, a contact address nobody monitored, or an expired payment method. All four are addressed by the hygiene in Part Four, and none of them is expensive.

Part Five: The Layers Without a Remedy

Social handles. No dispute policy analogous to the UDRP. Recovery runs through platform impersonation and trademark reporting processes, which work considerably better with a registration than without one. Platforms rarely release dormant handles, and a handle held by an inactive account is frequently unrecoverable at any price the holder will accept. The practical answer is to claim handles early, across every platform, registered to the entity at a role address. See When the Platform Turns You Off; Platform Account Risk Checklist.

Blockchain naming records. Registered on-chain, freely transferable, and outside any registry that could order a reassignment. There is no arbitration provider and no registrar to serve. Recovery requires identifying the holder and obtaining a judgment enforceable against them, which is frequently impossible. Registering defensively costs very little; recovering costs everything or nothing.

App store listings. Removal is the remedy, through the store's trademark complaint process, and it works reasonably well with a registration.

Marketplace storefront names. Handled through the marketplace's brand program. See Marketplace and Platform Liability Toolkit.

Country-code domains. Governed by each registry's own policy. Many have adopted the UDRP or a close analogue; some have their own procedures; some require a local registration or a local presence to register at all, which makes the international filing map a prerequisite to the domain strategy. See International Trademark Toolkit.

Part Six: The Other Chair

The defensive analysis matters, because overreaching in this area has a named consequence.

Reverse domain name hijacking. Where a complainant brings a UDRP proceeding in bad faith or to harass a registrant, a panel may make an express finding of reverse domain name hijacking. It carries no monetary sanction, and it is published — which is a real reputational cost for a brand and its counsel.

Legitimate registrant positions. Use of the domain for a bona fide offering before notice of the dispute. Being commonly known by the name. Noncommercial or fair use, including criticism. A descriptive term used descriptively. And a resale business in domains, which is lawful in itself; the ACPA and the UDRP target bad-faith targeting of a specific mark, not the domain aftermarket generally.

The reverse-hijacking cause of action at 15 U.S.C. § 1114(2)(D)(v) permits a registrant whose domain was suspended, disabled, or transferred under a policy to sue for a declaration that its registration is lawful and for reinstatement.

Criticism and commentary sites deserve particular care. A demand against a critic converts a small site into a news story with a First Amendment frame, and the underlying claim is frequently weak. See The First Amendment and Trademark Toolkit; Trademark Defenses Toolkit.

Part Seven: The Evidence

Domain cases are won on captured evidence, and the evidence disappears.

Capture immediately. Screenshots of the resolving page with the URL and date visible, the full page including any advertising, and the page source where relevant.

Capture the registration data. The registrant record, the registrar, the creation and expiry dates, the nameservers, and any historical records available through archival services. Registration data is increasingly redacted, which makes historical captures more valuable.

Capture the pattern. Other domains held by the same registrant, other domains on the same nameservers, and other domains with the same registration timing. A pattern of registrations targeting multiple brands is powerful evidence of bad faith and is what converts a single-domain complaint into a strong one.

Capture the offer to sell, if there is one, in full, with headers.

Capture the archive. How the domain resolved over time frequently establishes both the bad faith and the absence of any legitimate interest.

And keep it. Domain disputes recur with the same actors, and a file from three years ago is the fastest route to establishing a pattern today.

Part Ten: Budgeting the Defensive Portfolio

Clients ask how many domains to register, and the honest answer is a framework rather than a number.

Start from the commercial map, not from the alphabet. Which top-level domains do your customers actually use? For most businesses the answer is one primary, plus a handful of country-code domains in markets with real revenue, plus any category-specific top-level domain your competitors have adopted. Everything beyond that is speculative.

Then add the four defensive categories.

Typographical variants of the primary domain. Adjacent-key substitutions, transpositions, doubled and dropped letters, and the omitted dot. For a one-word brand this is a handful of registrations; for a long compound name it is more, and at some point the tail is not worth it.

Homophones and common misspellings, which are how customers actually mistype rather than how a keyboard-adjacency model predicts.

Hyphenated and unhyphenated forms, where the brand is two words.

The obviously hostile variants — the brand plus a pejorative, the brand plus "scam," the brand plus "sucks." Whether to register these is a genuine judgment call: registering them removes an easy target, and it also looks defensive if it ever becomes public, and it does not prevent a critic from using a variant you did not think of. Many brands register a small number and accept that the category is unbounded.

What not to do. Register every string in every top-level domain. It is unbounded, it costs real money annually, and it addresses a risk that the Clearinghouse claims service and a watch service address better and cheaper.

Use blocking services where they fit. A registry-level block covering a mark across a family of top-level domains, for one fee, beats individual registrations at scale.

Review annually and prune. Defensive registrations accumulate and are never reviewed. Some of them protected a product that no longer exists, or a market never entered. An annual pass through the register, dropping what no longer maps to the business, keeps the cost proportionate. See Domain Portfolio Checklist.

And redirect what you hold. A defensive registration parked with a placeholder page is a missed opportunity and occasionally a liability; pointing it at the primary site is trivial, captures the traffic the registration was meant to protect, and demonstrates use if the registration is ever questioned.

Part Eight: Cost Map

| Item | Relative cost | Notes | |---|---|---| | Clearinghouse recording | Very low, recurring | Highest-return prevention | | Defensive registrations, targeted | Low, recurring | Budget it rather than sprawl | | Registry-level blocking services | Moderate, recurring | Better value at scale | | Registrar consolidation and locks | Low, one-time | Prevents the common loss | | Watch service | Low, recurring | Only if someone reads it | | URS filing | Very low | Suspension only | | UDRP filing | Low | Transfer, about sixty days | | Negotiated purchase | Variable | Often the fastest route | | ACPA action | High | Money and deterrence | | Redemption of a lapsed domain | Moderate | Entirely avoidable | | Recovery of a lapsed and re-registered domain | Very high, often impossible | The reason hygiene matters |

The ratio. The entire prevention program — Clearinghouse, targeted defensive registrations, locks, role contacts, auto-renew verification, and a register — costs less annually than a single UDRP proceeding, and it eliminates most of the events that would require one.

Part Nine: What Happened to the Five Problems

The typosquat went to a UDRP. The registrant did not respond, the pay-per-click use and the pattern of similar registrations established bad faith, and the domain transferred in about sixty days for a modest fee.

The new-gTLD registration was caught by a claims notice from the Clearinghouse, which is exactly what the service is for. Because the mark was recorded and the registration was an exact match with no plausible legitimate interest, a URS produced suspension in under three weeks, and a subsequent UDRP obtained transfer.

The near-lapse was the serious one, and it produced the most change. The company consolidated fifteen domains from four registrars into one, moved registrant contacts to role addresses on a secondary domain, enabled registry lock on the primary, extended registration terms, and put an annual payment-method verification on the calendar. Cost: an afternoon and some renewal fees. Avoided cost: the entire business, briefly.

The dormant social handle was not recovered. The holder was not impersonating, was not using the brand commercially, and had held the handle since before the company's expansion. The platform's trademark process declined to act. The company took a close variant, secured every other platform, and let it go — which is frequently the correct answer and always an unsatisfying one.

The blockchain name was likewise not recovered. The company registered the variants it could, noted the exposure, and moved on. Counsel's advice was that a recovery action against an unidentified holder would cost more than the asset was worth and would probably fail — which is the honest analysis for most of this layer today.

A closing note on proportion. Domain enforcement is the area where brand-protection budgets are most easily consumed by activity that changes nothing. A watch report full of registrations nobody will ever use, chased one at a time, produces filings and no benefit. The disciplined program spends most of its money on prevention, files a small number of proceedings against registrations that actually cause harm, buys the occasional domain where buying is cheaper than fighting, and lets the rest go.

A Suggested Reading Path

If you have a specific problem right now, branch:

A domain you want back. UDRP vs. Federal Lawsuit → UDRP Complaint Checklist → Filing a UDRP Complaint → UDRP Complaint Template.
A complaint served on you. Responding to a UDRP Complaint → Descriptive and Nominative Fair Use.
You need money or an anonymous registrant. Cybersquatting and the ACPA → Suing a Foreign Infringer.
You are building the portfolio. After .com → Building a Domain Name Portfolio and Enforcement Program → Domain Portfolio Checklist.
Handles and accounts. When the Platform Turns You Off → Platform Account Risk Checklist.

If you are building the program from nothing, read in this order:

After .com — the prevention layer.
Domain Portfolio Checklist — hygiene, where the real losses are.
UDRP vs. Federal Lawsuit — the forum decision.
Building a Domain Name Portfolio and Enforcement Program — the operating program.
Cybersquatting and the ACPA — the escalation.
Platform Account Risk Checklist — the layers with no dispute system.

Primary Authorities

| Authority | Rule, in one line | |---|---| | 15 U.S.C. § 1125(d)(1) | ACPA liability for bad-faith registration, trafficking, or use of a confusingly similar domain; nine bad-faith factors. | | 15 U.S.C. § 1125(d)(2) | In rem action against the domain where personal jurisdiction is unavailable. | | 15 U.S.C. § 1117(d) | Statutory damages per domain name, elected before final judgment. | | 15 U.S.C. § 1114(2)(D) | Registrar immunity for good-faith action; reverse-hijacking cause of action. | | 15 U.S.C. § 8131 | Cyberpiracy protection for personal names of living individuals. | | 15 U.S.C. § 1114 | Infringement of a registered mark. | | 15 U.S.C. § 1125(a) | False designation of origin; the claim for unregistered rights. | | 15 U.S.C. § 1125(c) | Dilution; the alternative theory for famous marks. | | 15 U.S.C. § 1116 | Injunctive relief. | | 15 U.S.C. § 1117(a) | Profits, damages, costs, and fees in exceptional cases. | | 15 U.S.C. § 1051 | Registration; the prerequisite for the URS and for most platform processes. | | 15 U.S.C. § 1057(b) | Certificate as prima facie evidence, useful in every proceeding here. | | 15 U.S.C. § 1127 | Definitions; use in commerce and the mark itself. | | 28 U.S.C. § 1391 | Venue, including for the in rem action's location. | | Fed. R. Civ. P. 4(f)(3) | Court-ordered alternative service on a foreign registrant. | | Fed. R. Civ. P. 65 | Temporary restraining orders and preliminary injunctions. |

Forms and Templates

UDRP Complaint Template is the working instrument, and the drafting discipline is simple: address the three elements in the order a panel reads them, put the evidence in numbered annexes rather than describing it in the body, and lead the bad-faith section with the pattern evidence if there is any. Panels decide on documents; a complaint that asserts what an annex could show is a weaker complaint. Read it with Filing a UDRP Complaint.

Cease-and-Desist Template is the alternative opener, and in the domain context it should be used carefully: a demand to a registrant who has a colorable position can produce a declaratory action, and a demand to a critic produces publicity. Where a purchase is the likely outcome, an inquiry that does not assert rights preserves the option of buying at a sensible price — a rights-asserting letter tends to raise the asking price rather than lower it.

For a negotiated purchase, the working structure is: an escrow arrangement, payment released on completed transfer at the registrar, a representation of authority to transfer, a covenant not to register confusingly similar variants, and a release. The Assignment Agreement Template supplies the granting and warranty architecture; adapt the granting clause to the asset, since a domain registration is a contractual right rather than a trademark.

Related Toolkits and Checklists

Online Brand Protection Toolkit is the surface map across all six online channels, and this toolkit is its domain and identity chapter. Marketplace and Platform Liability Toolkit covers the storefront and account layers.

Virtual Goods and Digital Brand Toolkit covers on-chain naming and the digital-goods layer. Global Brand Enforcement Toolkit covers country-code domains and the cross-border enforcement the in rem route addresses.

Trademark Clearance and Brand Selection Toolkit covers the domain and handle sweep that belongs inside clearance rather than after it. Trademark Defenses Toolkit is what a registrant reads, and reading it first tests your own complaint. The Brand Owner's Master Toolkit indexes the shelf.