Domain name disputes: the UDRP, .ke and .ae
Domain disputes are one of the few areas of internet law with a fast, cheap, genuinely effective procedure. It also has a trademark prerequisite that defeats most of the complaints people want to bring.
Where an entire domain is the problem — a cybersquat, a lookalike site, a dedicated attack site — the dispute-resolution procedures attached to domain registration are among the most effective tools available anywhere in internet law. They are fast, they are relatively cheap, and they do not require litigation.
They are also narrower than most complainants expect.
The UDRP: three elements, all required
The Uniform Domain-Name Dispute-Resolution Policy applies to generic top-level domains and to many country-code domains that have adopted it. Under paragraph 4(a), the complainant must prove all three of the following:
- The domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
- The registrant has no rights or legitimate interests in respect of the domain name; and
- The domain name has been registered and is being used in bad faith.
The third element is conjunctive. Bad faith must be shown in both the registration and the subsequent use. A domain registered innocently and later put to a bad-faith use routinely fails under the UDRP, which is a recurring source of frustration for complainants with an otherwise strong case.
Paragraph 4(b) sets out a non-exhaustive list of bad-faith circumstances: acquisition primarily to sell the name to the mark owner or a competitor for more than out-of-pocket costs; registration to prevent the mark owner from reflecting the mark in a corresponding domain, where part of a pattern; registration primarily to disrupt a competitor’s business; and use of the domain to attract users for commercial gain by creating a likelihood of confusion with the complainant’s mark.
Paragraph 4(c) sets out how a respondent establishes rights or legitimate interests: bona fide use or demonstrable preparations before notice of the dispute; being commonly known by the domain name; or legitimate non-commercial or fair use without intent for commercial gain to misleadingly divert consumers or tarnish the mark. That last limb is why criticism and commentary sites frequently survive.
The trademark prerequisite
The UDRP protects marks, not people. This defeats a large share of the complaints clients want to bring.
An individual with no registered mark must establish unregistered or common-law rights, which for a personal name generally requires showing that the name functions as a trademark or service mark in trade or commerce — not merely that the person is well known. Fame alone is not enough. A businessperson trading under their own name is in a much stronger position than a private individual whose name has been registered by someone with a grievance.
Where there is no mark, the domain is not the right target and the complaint should be redirected to the content, the host, or an ordinary claim against the registrant.
What the UDRP gives you — and what it does not
Under paragraph 4(i), the remedies are limited to cancellation of the domain name or transfer of the registration to the complainant.
There are no damages, no costs award, no injunction, and no order about the content on the site. If the same operator republishes at a different domain the following week, the decision does nothing about it. The UDRP solves a name problem. It does not solve a content problem.
Timeline and cost
At the WIPO Arbitration and Mediation Center, which with Forum is one of the two dominant providers:
- The respondent has 20 days from commencement to file a response, with an automatic four-day extension available.
- The panel must forward its decision within 14 days of appointment, absent exceptional circumstances.
- Typical total: within two months of WIPO receiving the complaint.
- The fee is USD 1,500 for a single-member panel covering one to five domain names, payable in full by the complainant. Where the complainant elects a three-member panel it pays the full fee; where only the respondent elects three members, each party nominates a panellist and the fee is shared equally.
- The panel cannot award money judgments or legal costs. Legal fees are separate and typically exceed the filing fee.
Under paragraph 4(k) the registrar must wait ten business days after being notified of a decision before implementing it. If the respondent files suit in a court of mutual jurisdiction within that window and supplies documentation, the registrar takes no further action — so an adverse decision is not the end of the road for a determined registrant.
The URS: faster, cheaper, and you keep nothing
Uniform Rapid Suspension is the streamlined alternative, administered by a smaller set of providers. Its substantive elements mirror the UDRP’s three, but they must be established to a clear and convincing standard — deliberately higher than the UDRP’s balance of probabilities — because the procedure is designed only for the most clear-cut cases in exchange for lower cost and greater speed.
The trade-off is in the remedy. URS results in suspension, not transfer: the domain is parked and does not resolve, and the complainant acquires nothing. Use URS to stop active harm quickly. Use the UDRP when you want the name. Confirm the current response deadlines and fees with the provider before advising on either, as these are revised from time to time.
Kenya: .ke
The .ke registry is operated by KeNIC, and .ke registrations are subject to a dispute-resolution policy incorporated into the registration agreement, closely modelled on the UDRP in its elements and remedies. WIPO does not act as a provider for .ke, so the UDRP route through WIPO is not available for these names.
The current policy text, the designated dispute-resolution body and the applicable fees and timelines should be obtained directly from KeNIC before a complaint is prepared. Third-party summaries of .ke procedure circulate widely and are not a safe basis for planning.
The UAE: .ae, and a materially better test
Disputes over .ae and the Arabic internationalised domain are governed by the Domain Name Dispute Resolution Policy for .ae, issued by the .ae Domain Administration under the Telecommunications and Digital Government Regulatory Authority. The WIPO Arbitration and Mediation Center is the dispute-resolution provider, and proceedings default to English unless the parties agree otherwise.
The elements look familiar, with one decisive divergence. The complainant must show that the domain is identical or confusingly similar to a mark in which they have rights; and that the registrant has no rights or legitimate interests; and that the domain has been registered or is being used in bad faith.
That third element is disjunctive. Bad faith at registration or in subsequent use will suffice, where the UDRP requires both. This makes the .ae policy materially easier for a complainant, and it captures precisely the fact pattern that routinely fails under the UDRP — a domain registered innocently and later turned to a bad-faith purpose.
The remedies are the same and equally limited: cancellation or transfer. Either party may go to court before or after the administrative proceeding, and the registrar observes the same ten-business-day window before implementing a decision.
Finding out who the registrant is
Since the arrival of the EU General Data Protection Regulation, registrant contact data in public WHOIS and RDAP output is redacted for most generic top-level domain registrations. Name, address, email and telephone are typically replaced with redaction notices or an anonymised forwarding address.
ICANN operates a Registration Data Request Service as a free, centralised route for requesting non-public registration data from participating registrars. It is worth using — but it is not a reliable unmasking tool. Over the two-year pilot that ran from November 2023 to November 2025, more than 3,700 disclosure requests were submitted, of which 26 per cent were approved and 55 per cent denied, with participating registrars covering less than half of gTLD domains by the end of the period. The service continues while longer-term access policy is developed.
Treat it as one step, not the plan. Where identification is genuinely necessary, plan from the outset for a disclosure application or the local equivalent — and note that in Kenya the availability of the English disclosure jurisdiction against intermediaries has not, so far as we are aware, been settled by Kenyan authority. Where the relevant data sits with a DIFC-licensed entity, the DIFC Courts have granted disclosure relief of this kind, including in support of foreign proceedings.
The risk of getting it wrong
The UDRP Rules define reverse domain name hijacking as using the Policy in bad faith to attempt to deprive a registered domain-name holder of a domain name. Under Rule 15(e), a panel that finds a complaint was brought in bad faith — including in an attempt at reverse hijacking, or primarily to harass the holder — shall declare that finding in its decision.
There is no express sanction. There are no costs and no damages. What there is, is a published, permanent, indexed decision under the complainant’s own name, recording that they abused the procedure. Reverse hijacking findings are uncommon — they appeared in roughly 1.3 per cent of UDRP decisions across all providers in one recent quarter — but the reputational cost of one, for a business or a professional, is real and lasting.
The same logic applies here as to copyright takedown notices. A dispute procedure used as a weapon against a legitimate registrant — a critic, a former business partner, a genuine prior user — produces a public record of the attempt.
It describes the law as understood at the date of review and does not take account of your circumstances. Law and platform practice both change. Reading it does not create an advocate–client relationship with JM Sons Advocates. Before acting or deciding not to act, take advice on your own facts.