How to get your domain name back

Your site is down. Or worse, your domain now loads a parking page stuffed with ads for your competitors.

You have probably already found three articles telling you to contact your registrar. That advice is right for exactly one of the three things people mean when they say they lost a domain.

Either it lapsed and nobody else has taken it. Or it was transferred out of your account without your permission. Or somebody else registered it and holds it right now.

Three different problems, three different fixes, and only the last one is a legal fight. So the answer to how to get my domain name back depends entirely on which one you are dealing with, and sorting that out takes about five minutes.

Step 1: Look up who owns it now

Before you call anyone, find out what actually happened. A WHOIS lookup gives you the answer in two fields.

Run the domain through ICANN’s lookup tool and read the registrant and the status. Registrant tells you who holds it. Status tells you where in its lifecycle it sits.

One thing that trips people up: since GDPR, most registrars redact the registrant’s name and contact details on personal registrations. A redacted record does not mean the domain is hidden or stolen, and there are ways to reach the holder anyway.

Now route yourself:

• Status shows a grace or redemption period, and no new registrant. It lapsed and nothing else has happened yet. Go to Step 2.
• You never let it lapse, but the registrant changed anyway. It was transferred without authorization. Go to Step 3.
• Your registration ran out and a third party now holds it. Go to Step 4.

You now know which of the next three steps is yours. Skip the other two.

Step 2: If it only expired, your registrar can still fix it

This is the good outcome, and it is also the most common one. No lawyer, no dispute, just a billing problem with a deadline attached.

An expired domain moves through stages. First an auto-renew grace period, commonly anywhere from 0 to 45 days depending on your registrar and the extension. Then a redemption grace period of roughly 30 days, where you can still restore it but the fee jumps well above a normal renewal.

After that comes pending delete. Once it drops, the name is public and anyone can register it.

Call your registrar rather than emailing them. These windows are short, they vary by registrar, and a support ticket sitting in a queue for four days can cost you the name.

While you are in the account, fix the thing that caused this. In almost every one of these cases I see, the renewal notices were going to an email nobody checks anymore or billing was running against a card that expired. Update both, then turn on auto-renew.

If the domain is inside a redemption window and nobody else has claimed it, you are done. The rest of this article is for people whose name is now in somebody else’s hands.

Step 3: If it was transferred out without your permission, start with the registrar

Squatting and hijacking get treated as the same problem, and they are not. Squatting is somebody registering a name you did not hold. Hijacking is somebody taking a name you did hold.

If you were paid up and current and the registrant changed anyway, that is the second one. It usually happens through a compromised registrar account or a transfer approval that somebody social-engineered.

That difference changes where you go first. Because the transfer itself was improper, this is a registrar and transfer-policy problem, not a cybersquatting complaint. Filing a UDRP here can waste two months solving the wrong problem.

Contact both registrars in writing, the one you used and the one the domain moved to. Ask for a transfer reversal, state plainly that you did not authorize it, and escalate to each registrar’s abuse or compliance contact rather than front-line support.

Be aware this may be bigger than a domain issue. Unauthorized account access and a forged transfer approval can involve fraud and computer-access law, which is worth raising early rather than after the trail goes cold.

Step 4: Find out whether you have a legal claim at all

Now the part that surprises people. Registering a domain that somebody else wanted is not, by itself, illegal.

There is no general legal right to a domain name just because you used to own it. What gets one back from an unwilling holder is trademark rights, and without them you have no cybersquatting claim at all.

The three things you have to prove

A UDRP complaint requires all three of these, not two of three:

1. The domain is identical or confusingly similar to a trademark or service mark in which you have rights.
2. The registrant has no rights or legitimate interests in the domain.
3. The registrant registered and is using the domain in bad faith.

Miss any one and the complaint fails.

Elements two and three are where weak cases die. Somebody running a real domain resale business may have a legitimate interest in a generic name, and a domain registered before your business existed cannot have been registered in bad faith against you.

You might have rights without a registration

A federal registration makes this simple, but unregistered common law rights can satisfy the first element too. That is the lifeline for a lot of small businesses.

Per WIPO’s own guidance, you have to show the name “has become a distinctive identifier which consumers associate with” your goods or services. That means length of use, sales, advertising, public recognition.

WIPO is blunt that “conclusory allegations” of acquired distinctiveness “would not normally suffice.” The bar rises sharply for descriptive names, and where yours sits on the five levels of name strength largely predicts how this goes.

Honest read: a descriptive name you used for six months is a bad case, and a distinctive name you have traded under for years is a strong one. If you land in the middle, spend an hour with an attorney before you spend $1,500 on a filing.

Step 5: Document everything before you contact anyone

The evidence that wins these cases is the evidence that disappears the moment the other side knows you are looking.

A parking page listing your domain for $25,000 is often the single best proof of bad faith you will ever get. It can also come down the day after you email them.

So capture first, talk second:

• Screenshot the WHOIS record with the date visible.
• Screenshot whatever the domain currently resolves to, especially a for-sale listing, an ad-stuffed parking page, or a competitor’s content.
• Save any price the holder has quoted you, in whatever channel they quoted it.
• Pull together your own proof of use: first-use dates, invoices, ad spend, traffic history.

That last one is doing double duty. It is also the evidence that carries element one if you do not have a registration.

Date-stamp everything and store it somewhere outside the account you are fighting over. I have seen people lose their proof because it lived in an email account tied to the compromised domain.

Step 6: Pick your forum, because one gets the domain and the other gets money

There are two ways to force a domain out of somebody’s hands, and they deliver completely different things.

The first is a UDRP proceeding. Every ICANN-accredited registrar of a generic top-level domain like .com, .net, or .org has agreed to be bound by it, which is what makes it work at all.

It is an administrative proceeding, decided on written submissions, ordinarily with no hearing and no court appearance. Not arbitration, and the distinction matters: a UDRP decision does not stop a court from hearing the same dispute fresh. Country domains like .us and .co.uk run their own variants with their own rules.

Then there is the limitation that competitors bury and that changes the entire calculation. Quoting WIPO’s guide directly: “The Panel cannot award money judgments, nor lawyers’ costs.”

The relief a panel can actually order is transfer or cancellation. It can also deny your complaint, and if it thinks you brought the case in bad faith it can make a finding of reverse domain name hijacking against you. None of it is a check.

Transfer is almost always what you want. Cancellation just releases the name back into the pool, where somebody else can register it.

If you want to be paid for the damage, that is federal court under the Anticybersquatting Consumer Protection Act.

Those statutory damages are elected at your option, so you do not have to prove exactly what the squatting cost you. That is genuinely valuable, and it is also a full federal lawsuit with everything that implies in cost, time, and risk.

My honest recommendation: if you want the domain, file a UDRP. If a squatter has done real, measurable damage to a business and you want compensation for it, that is a litigation conversation and a different undertaking entirely.

Step 7: What a UDRP actually looks like, start to finish

You are going to want to know how long your site stays broken. The process runs on a fixed schedule, which is the best thing about it.

You file the complaint with an accredited provider and pay the fee. WIPO is the best known. Worth noting because the internet gets this wrong constantly: ICANN publishes the policy but does not decide disputes, so do not go looking for an ICANN complaint form.

The provider reviews your filing and notifies the registrant, which formally commences the proceeding. The registrant then has 20 days to respond, and can request a 4-day extension on top of that.

After the response deadline passes, the panel is appointed. From there, “the Panel shall forward its decision on the Complaint to WIPO within 14 days of its appointment.”

Win, and the registrar does not transfer the domain right away. It has to wait ten business days after the provider notifies it of the decision, and only then implement.

Read that window the right way, because it is not a delay in your favor. Those ten business days exist for the registrant. If they produce documentation showing they have filed suit against you in the applicable court, the transfer is paused until that case resolves. It is not common, but a determined holder with money can use it.

The part nobody mentions: you are agreeing to be sued somewhere

Filing a complaint means naming a “mutual jurisdiction” in it, and that has a consequence worth understanding before you file rather than after.

You are consenting to a court in that location hearing a challenge to the outcome. It is either where the registrar has its principal office or the registrant’s address in the registrar’s records. If your squatter used a registrar in another country, that can mean consenting to a foreign court.

This is why “no lawsuit required” is true about the UDRP itself and not the whole picture. The proceeding needs no lawsuit. But a determined registrant can start one, and you have already agreed to where.

For most cases this never comes up. Squatters holding a parking page are not usually the type to fund federal litigation. But if you are going after a domain held by a real company with real counsel, factor it in.

Overall, WIPO puts it this way: “If there are no procedural issues, the case normally should be completed within 2 months from the date WIPO receives the Complaint.”

One expectation to set. Plenty of registrants never respond at all, and a default is not an automatic win. You still have to actually prove all three elements to a panel, which is why the complaint itself is the whole ballgame.

Step 8: Four moves that make your case worse

Most of the damage in these disputes happens in the first hour, before anybody has taken legal advice.

1. Offering to buy it before you know your position. Your offer is a document, and it can be read as treating their claim to the name as legitimate. Get the assessment, then negotiate.

2. Sending a threat you cannot back up. A demand letter that overstates the law gets refused, tips the holder off, and buys them time to clean up the evidence you needed. Here is what actually happens when someone receives one.

3. Assuming you are the one in the right. File against a registrant with a genuine legitimate interest and a panel can find reverse domain name hijacking against you. That is a published decision with your business name on it.

4. Waiting. Redemption windows close, parking pages change, and a holder can sell the name onward, which complicates who you are even proceeding against.

If you are looking at a WHOIS record with somebody else’s name on it and you are not sure which step is yours, that is worth a short conversation. I mostly represent game companies, but a domain dispute runs the same way in any industry.

I can usually tell you quickly whether you have a case worth filing, and if you have no trademark rights yet, that is the thing to fix first. Get a flat-fee quote and we will scope it before you commit.

FAQ

Someone else registered my domain name. Can I make them give it back?

Only if you have trademark rights in the name. You have to prove the domain is confusingly similar to your mark, that the registrant has no legitimate interest, and that they registered and used it in bad faith. Registering a name you happened to want is not illegal on its own.

How much does a UDRP complaint cost?

WIPO charges $1,500 for a single-panelist case covering one to five domain names. A three-member panel is $4,000, and there are higher published bands once you get past five domains. The complainant pays the filing fee, with one exception: if you file for a single panelist and the registrant elects a three-member panel, that fee is split evenly, so your share is $2,000 rather than $1,500. Attorney fees sit on top of all of it and are not recoverable even when you win.

For what it is worth on this side: my flat fee for a UDRP complaint is $1,200, covering one complaint over as many as five domain names held by the same registrant. Add WIPO’s $1,500 and a straightforward single-panelist case lands around $2,700, and it stays there whether the squatter took one spelling of your name or five. Two things move that number: if the registrant elects a three-member panel, WIPO’s share of your cost goes to $2,000, and domains held by unrelated registrants cannot be combined into one complaint, so those are separate filings.

How long does it take to get a domain back?

Roughly two months from filing, if nothing procedural goes sideways. The registrant gets 20 days to respond and can request a 4-day extension, the panel decides within 14 days of appointment, and then the registrar waits ten business days before implementing the transfer. If the registrant files a court challenge inside that window, the transfer pauses until the case resolves.

Can I get damages from a domain squatter?

Not from a UDRP panel, which can only transfer the domain, cancel it, or deny your complaint. Money means a federal lawsuit under the ACPA, where statutory damages run from $1,000 to $100,000 per domain name at your election.

What if I never registered a trademark?

Common law rights can still get you there, but you have to prove the name became a distinctive identifier consumers associate with your business. Panels want evidence: years of use, sales, advertising, public recognition. Descriptive names face a much harder time, so read how to protect a name properly before your next one.

Is it cheaper to just buy the domain back?

Sometimes, and there is no shame in it. With no trademark rights, a negotiated purchase may be your only realistic route. Get your position assessed first, because an offer made before you understand your rights can weaken a complaint you file later.