Domain names operate under rules set by the Internet Corporation for Assigned Names and Numbers, known as ICANN, and those rules reach you through the registrar you bought your domain from. ICANN domain regulation is a layered system: ICANN writes the policies, registries run the master databases for extensions like .com and .org, and accredited registrars sell and manage individual names under a contract with ICANN.1Internet Corporation for Assigned Names and Numbers. Articles of Incorporation of Internet Corporation for Assigned Names and Numbers That structure determines what you must do to keep a domain, how you move it, what happens when you let it lapse, and how a trademark owner can challenge it.
Who Sets the Rules and Who Enforces Them
ICANN sits at the top. It doesn’t sell domains and doesn’t hold registration data itself. It signs contracts with the registries that run each top-level domain and with the registrars accredited to sell names to the public.
Registries maintain the authoritative database for a given extension and connect each domain to the correct servers. Registrars are the customer-facing companies, and every one of them operates under the Registrar Accreditation Agreement, which sets the rules for registration, renewal, transfer, and dispute handling. If a registrar breaks that agreement, ICANN’s compliance department can investigate and, in serious cases, revoke accreditation. That is the enforcement backbone that keeps the system consistent across hundreds of millions of active domains.
What You Agree To When You Register a Domain
Registering a domain is a contract. Through your registrar, you’re bound by ICANN’s Registrar Accreditation Agreement, and it requires accurate contact details: name, physical address, email, and phone number. Your registrar must verify your email address or phone number during registration.2ICANN. 2013 Registrar Accreditation Agreement
Two ongoing duties matter most. If your registrar has reason to believe your information is wrong (a bounced email, for instance) and asks you to re-verify, you have 15 calendar days to respond. And any time your contact details change, you must update them within seven days. False information, missed updates, or ignored verification requests all count as material breaches, and your registrar can suspend or cancel the domain with no refund.2ICANN. 2013 Registrar Accreditation Agreement ICANN’s compliance department audits registrars to make sure they enforce these rules.
How Registration Data Is Looked Up
For years, anyone could pull a domain’s registrant name, address, and phone number from the public WHOIS database. That changed on January 28, 2025, when ICANN replaced WHOIS with the Registration Data Access Protocol, or RDAP. RDAP provides the same lookup function with support for international characters, secure access, and different permissions for different requesters.3Internet Corporation for Assigned Names and Numbers. ICANN Update: Launching RDAP, Sunsetting WHOIS
The change was partly a response to privacy pressure from the EU’s General Data Protection Regulation, which pushed registrars to redact personal details from public results for registrants covered by that law. ICANN then allowed registrars to apply those redactions globally where commercially reasonable, so most public lookups today return limited data no matter where the registrant lives.
Nonpublic data is still available to requesters with a legitimate interest. Law enforcement, intellectual property professionals, cybersecurity researchers, and government officials can request it through ICANN’s Registration Data Request Service for participating registrars, or by contacting the sponsoring registrar directly.3Internet Corporation for Assigned Names and Numbers. ICANN Update: Launching RDAP, Sunsetting WHOIS
Moving a Domain to a Different Registrar
You have the right to move your domain, but ICANN’s Transfer Policy builds in checks to prevent unauthorized transfers. You start by requesting your authorization code, sometimes called an EPP code or AuthInfo code, from your current registrar. The registrar must provide it within five calendar days.4ICANN. Transfer Policy
Some transfers are blocked outright. You cannot transfer a domain within 60 days of its initial registration or within 60 days of a previous transfer. A registrar may also apply a 60-day lock after a change of registrant, such as an update to the owner’s name, though you can opt out of that lock before making the change.4ICANN. Transfer Policy
Once the gaining registrar submits the transfer to the registry, the losing registrar has five calendar days to approve or deny it. If it doesn’t respond in that window, the transfer completes automatically.4ICANN. Transfer Policy That default-approval rule keeps registrars from holding domains hostage by ignoring requests.
What Happens If You Miss Your Renewal
A missed renewal doesn’t end the domain immediately, but recovery gets harder and more expensive at each stage.
Before expiration, ICANN’s Expired Registration Recovery Policy requires your registrar to send at least two reminders: one 26 to 35 days out, and another 4 to 10 days out. If the domain expires, the registrar must send at least one more notice within five days after expiration, with renewal instructions.5ICANN. Expired Registration Recovery Policy
Most registrars then offer an auto-renew grace period during which you can still renew at the normal price. Length varies by registrar but typically runs around 30 to 45 days. When that closes, the domain enters a 30-day Redemption Grace Period. During redemption the domain is off the air, but you can still restore it, usually for a significant fee set by your registrar and often well above the normal renewal cost. A restore is the only transaction allowed in this window.6ICANN. About Redeeming a Domain Name in Redemption Grace Period
Miss redemption and the domain moves into a five-day Pending Delete phase. No renewal, restore, or transfer is possible. After those five days the name drops back into the public pool and anyone can register it. Domain investors and automated backorder services track the deletion schedule, so desirable names rarely stay unregistered for long.
Trademark Disputes Under the UDRP
The Uniform Domain Name Dispute Resolution Policy lets a trademark owner challenge a domain registration through an administrative proceeding instead of a lawsuit. It applies to every generic top-level domain, and by registering, the domain holder has already agreed to be bound by it.7ICANN. Uniform Domain Name Dispute Resolution Policy
To win, the complainant must prove all three of the following: the domain is identical or confusingly similar to the trademark, the current holder has no legitimate interest in the name, and the domain was registered and is being used in bad faith.7ICANN. Uniform Domain Name Dispute Resolution Policy Failing on any one element means the complaint is denied.
The policy lists several indicators of bad faith:
- Registering the domain primarily to sell it to the trademark owner for more than out-of-pocket costs.
- Registering to block the trademark owner from using the mark, as part of a pattern of such registrations.
- Registering primarily to disrupt a competitor’s business.
- Using the domain to attract traffic for commercial gain by creating confusion about the source or sponsorship of the site.
Fees and Timeline
Complaints go through approved dispute resolution providers. The World Intellectual Property Organization, one of the most-used providers, charges $1,500 for a single-panelist case involving up to five domains and $4,000 for a three-member panel on the same number. For six to ten domains, the fees rise to $2,000 (single panelist) and $5,000 (three panelists).8World Intellectual Property Organization. Schedule of Fees Under the UDRP
The schedule is tight. The respondent has 20 days to submit a response, with a possible four-day extension on request. The provider appoints a panel within five days, and the panel must issue its decision within 14 days of appointment, absent exceptional circumstances.9ICANN. Rules for Uniform Domain Name Dispute Resolution Policy Most cases finish within about 60 days from filing to decision.
After the decision, the registrar waits 10 business days before carrying out a transfer or cancellation. If the losing party files a lawsuit and provides proof within that window, implementation is frozen until the court resolves the case.7ICANN. Uniform Domain Name Dispute Resolution Policy
Reverse Domain Name Hijacking
The UDRP protects registrants too. A panel can find “reverse domain name hijacking” when a trademark owner files a complaint in bad faith, for instance where the domain predates the complainant’s trademark rights, where there is no evidence of bad faith by the registrant, or where the complainant turns to the UDRP after failed negotiations to buy the name. The finding carries no monetary penalty, but it is published in the decision. The UDRP is not a tool for acquiring domains a brand owner wants but has no rights to.
Federal Court Under the Anticybersquatting Act
When the stakes are high, the facts complex, or the trademark owner wants money, federal court is the alternative. The Anticybersquatting Consumer Protection Act, at 15 U.S.C. ยง 1125(d), creates a federal claim against anyone who registers, sells, or uses a domain with a bad faith intent to profit from someone else’s trademark.10Office of the Law Revision Counsel. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden
Courts weigh nine bad-faith factors, including whether the registrant has any trademark rights in the domain, whether it has been used to offer legitimate goods or services, whether the registrant provided false contact information, and whether the registrant has accumulated multiple domains targeting others’ marks.10Office of the Law Revision Counsel. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden The overlap with the UDRP is intentional, but a court case allows discovery and testimony, so the analysis tends to go deeper.
The ACPA also offers remedies the UDRP does not. A court can award statutory damages of $1,000 to $100,000 per domain, giving trademark owners a path to recovery without having to prove exact losses.11GovInfo. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden A UDRP panel can only order transfer or cancellation.
If the domain holder can’t be found, often because of false registration details or offshore privacy services, the ACPA allows an “in rem” action filed against the domain name itself in the federal district where the registry or registrar sits.11GovInfo. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden In an in rem case the court can order transfer or cancellation but not statutory damages, since there’s no defendant to pay them.