Defensive registration vs enforcement: where to spend
Two roads lead to the same destination: a brand that does not lose business to a confusingly similar domain. The first road is bought in advance – defensive registrations that deny a squatter the obvious strings before abuse appears. The second road is reactive – enforcement through the UDRP or a national procedure after someone registers the name anyway. Neither road is always right. The decision turns on budget, zone coverage, how many strings matter, and how much tolerance the brand has for the 45-to-60-day disruption a live dispute creates.
Defensive domain registration means registering key strings – common-law variants, typosquats, and country-code equivalents – before a bad actor can. Enforcement means challenging an abusive registration through a UDRP complaint (filing fee from USD 1,500 at WIPO), a ccTLD procedure, or court action, after the abuse has occurred. The right allocation depends on the number of high-value strings, the zones the brand operates in, and whether the brand already faces active abuse.
This page lays out both options side by side, explains the real cost drivers on each side, and closes with a decision matrix covering four recognizable situations.
What defensive registration actually covers – and what it does not
A defensive portfolio places a brand owner in the registrant's seat for strings that a bad actor would otherwise register. The protection is immediate: a registered string cannot be cybersquatted because it is already taken. No complaint, no waiting, no panel discretion.
The catch is coverage. There are hundreds of gTLD extensions and over 1,500 ccTLDs. No portfolio can register every variant of every mark across every zone. Brands that try to build exhaustive coverage often pay renewal fees on hundreds of domains they never use, while still missing the one string an adversary chooses. Common typosquats – a transposed letter, a missing hyphen, a pluralized form – multiply the universe quickly. A brand with a six-letter name can face dozens of plausible variants in .com alone.
Defensive registration is also forward-looking only in the zones where registration is open to anyone. In a sunrise period for a new gTLD, a brand can use its Trademark Clearinghouse (TMCH) recordal to register before general availability. Outside a sunrise, the brand competes with any other applicant. For tightly controlled ccTLDs – those requiring a local presence or domestic registration – a foreign brand may not qualify to register defensively at all, leaving enforcement as the only option.
The realistic scope of a well-run defensive portfolio, in our practice, is a curated list of the highest-priority strings in the highest-traffic zones – typically .com, .net, and the key ccTLDs for operating markets – plus TMCH recordal to trigger Claims notices during new-gTLD general availability. That is protection, not perfection.
What enforcement actually delivers – and what it costs
Enforcement through the UDRP delivers a transfer or cancellation order in a matter of months, at a defined cost, with no requirement to have registered the string first. A standard WIPO case on a single domain runs to a decision in about two months, with the filing fee at USD 1,500 for a single-member panel. Since March 2026, WIPO also offers an expedited option delivering a decision in about one month, at a filing fee of USD 4,000.
Those are forum fees. Legal fees for drafting and filing a complaint add to the total. COGNOMEN's indicative legal fee for a UDRP complaint is USD 2,500–4,000 (set after a case assessment, separate from the forum fee). For most single-domain disputes that total lands well below the annual renewal cost of a broad defensive portfolio.
The limitation is that enforcement is reactive. The abusive domain has already been registered. During the dispute window, a well-run cybersquatter may be redirecting your brand's customers, hosting a competing site, or sending phishing emails under your name. The UDRP does not award damages for that harm. The only remedies under the Policy are transfer or cancellation – no monetary recovery, no costs award, no injunction.
Enforcement also requires meeting all three elements of Paragraph 4(a) of the UDRP: the domain is confusingly similar to a mark you hold; the registrant has no rights or legitimate interests; and the domain was registered and is used in bad faith. A case that fails on element two or three – because the registrant has a colorable legitimate use, or because the registration predates your trademark rights – does not result in a transfer. Registration risk is real.
For a read on whether the three UDRP elements are met on a specific domain, reach us at info@cognomenlaw.com.
The comparison: key dimensions side by side
The table below sets out the dimensions that drive the decision for most brand owners. Use it as a first orientation, not a final answer – the right split depends on facts the table cannot capture.
| Dimension | Defensive registration | Enforcement (UDRP / ccTLD) |
|---|---|---|
| Timing of protection | Immediate – before abuse occurs | Reactive – after registration by a third party |
| Zone coverage | Limited to zones where brand qualifies to register | Available wherever a UDRP-based or ccTLD procedure exists |
| Cost structure | Annual renewal fees per domain (ongoing) | Per-matter forum fee plus legal fee (one-time) |
| Typical entry cost (.com single string) | Low annual renewal; scales with portfolio size | WIPO filing fee USD 1,500 + legal fee from USD 2,500 (indicative) |
| Scalability with large portfolios | Cost grows linearly with string count | Multiple domains can be consolidated in one complaint against the same registrant |
| Damages/monetary relief | Not applicable | None under UDRP; only transfer or cancellation |
| Risk of dispute disruption | Eliminated for registered strings | Business impact during the dispute window (approx. two months) |
| Eligibility requirement | Must qualify to register in the target zone | Must hold trademark rights; must meet the three UDRP elements |
| New gTLD early access | Sunrise via TMCH recordal (at least 30-day window) | Legal Rights Objection during string evaluation if applicable |
| Outcome certainty | Certain for registered strings | Panel or expert discretion; no guaranteed outcome |
How do the real cost curves compare over time?
The financial argument for defensive registration looks strongest in year one, when acquisition cost is low and the brand is new or newly launched in a market. It weakens over time as the portfolio grows and renewals accumulate. An enforcement budget, by contrast, is zero in quiet years and concentrated in the years when abuse occurs.
Consider a brand operating in five major markets. A defensive portfolio covering .com, .net, and five key ccTLDs, plus three plausible typosquats each, produces roughly 40–50 domain registrations. At typical annual renewal rates, that is a recurring cost every year, indefinitely. If the brand never faces a domain dispute – and most brands face at least one, eventually – that recurring spend buys quiet. If abuse appears in a zone the portfolio does not cover, the defensive investment did not prevent the harm.
An enforcement-focused budget, by contrast, is held in reserve. If an abusive .com appears, a single WIPO filing resolves it for a defined amount in about two months. If five abusive domains appear in the same year against the same registrant, they may be consolidated in a single UDRP complaint, reducing per-domain cost materially. Panels have consistently held that multi-domain complaints are proper where all domains are registered by the same holder.
The honest answer is that neither extreme – pure defensive or pure enforcement – fits most brand owners. A curated defensive portfolio covering the highest-value strings, combined with a monitoring service and an enforcement retainer, is where most of our clients land after a considered review.
Can defensive registration fail even when the string is taken?
Yes – and the failure mode is less obvious than people expect. Registering a string defensively protects against new registrations of that exact string in that exact zone. It does not protect against homograph attacks (visually similar characters from different Unicode blocks), second-level domain variations in a newly delegated gTLD the brand never registered in, or registrations in zones that opened after the defensive portfolio was last audited.
There is also the question of what sits behind the defensive registration. A parked domain pointing to a registrar's default page is fine. A lapsed defensive domain that the brand forgot to renew becomes available to any registrant. In one matter we handled (a multi-zone brand, spring 2026), a domain that had been held defensively for years lapsed during a billing transition, was picked up within 72 hours by a third party, and required a UDRP filing to recover – at a total cost far exceeding the renewal fee the brand had failed to pay.
Domain due diligence – auditing the portfolio, verifying chain of title, and checking the prior dispute history of domains being considered for acquisition – is the tool that catches these gaps before they become enforcement problems. For any domain being acquired by purchase rather than original registration, a due-diligence check on the chain of title is not optional; it is the first step.
Where should you spend? A prose decision matrix for four situations
Four situations recur in our practice, each with a different answer.
Situation 1: a brand launching into a new gTLD during a sunrise period. Register defensively during the sunrise window. The Trademark Clearinghouse recordal is the mechanism; the sunrise gives the brand at least 30 days before general availability. An enforcement action cannot remove a registration made in good faith by a party who registers during general availability before you do. Prevention is the only practical tool here. Cost: TMCH recordal fee (confirm the current rate with the TMCH operator) plus the sunrise registration fee for each string.
Situation 2: a brand with a large .com portfolio facing occasional typosquatting. Budget primarily for enforcement, not expansion of the defensive portfolio. A well-targeted UDRP filing – consolidated across all typosquats held by the same registrant – is almost always less expensive than registering every plausible variant in advance. The filing fees and legal costs for a consolidated complaint are a one-time outlay; renewal fees compound. Monitor actively, file promptly when abuse appears.
Situation 3: a brand entering a European operating market and concerned about .eu and local ccTLDs. Split the budget. Register the brand's primary .eu string defensively, because .eu requires an EU/EEA nexus and registration is relatively inexpensive. For the long tail of ccTLDs in markets where the brand has no local presence, an enforcement path (EURid/ADR.eu for .eu disputes, or the applicable national procedure for other ccTLDs) is more practical than attempting local registration in every country. For .uk specifically, the Nominet DRS – now administered by WIPO since July 2026 – provides a cost-effective expert-decision route at GBP 750 + VAT for a full decision.
Situation 4: a brand acquiring a high-value domain by purchase. Neither defensive registration nor enforcement is the primary tool – due diligence is. Before paying a five-figure or six-figure price for a domain, verify the chain of title, check the prior dispute history, and confirm there is no live UDRP, Nominet DRS, or court action against the registration. A domain purchased with an undisclosed dispute history can be transferred away from the buyer by the outcome of proceedings the buyer did not know about. Enforcement after purchase does not undo that outcome.
To plan a defensive portfolio review or assess a specific enforcement target, contact info@cognomenlaw.com.
About COGNOMEN
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. Our practice covers the full spectrum from defensive portfolio management and pre-acquisition due diligence through active enforcement and contested disputes, with published fee ranges so clients can model the cost before committing. To discuss a domain, contact info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
Which option is faster?
Defensive registration is instantaneous – the moment you register a string, no one else can register it in that zone. Enforcement is reactive: a standard UDRP proceeding at WIPO takes about two months from filing to decision, with an expedited option (available since March 2026) delivering a decision in about one month at a higher filing fee. If abuse has already occurred, enforcement is the only path; speed is then a function of which WIPO track you choose, not of the choice between registration and enforcement.
Which option costs less overall?
There is no universal answer. A narrow defensive portfolio covering only the highest-value strings in the brand's operating zones is often less expensive than a single UDRP filing over a multi-year horizon. A broad defensive portfolio covering every plausible variant in every zone accumulates renewal costs that quickly exceed the cost of enforcing against the handful of abusive registrations that actually appear. Most brand owners spend less by combining a curated defensive portfolio with an enforcement-ready posture and active monitoring, rather than attempting comprehensive defensive coverage.
Can I pursue both, and in what order?
Yes. Many brand owners run a defensive portfolio for their highest-priority strings and maintain an enforcement budget for everything outside that perimeter. The typical order is: register defensively during launch and sunrise windows; monitor for new abusive registrations; file a UDRP or ccTLD complaint promptly when abuse appears. For a domain being acquired by purchase, due diligence comes first – before either a defensive registration decision or any enforcement filing – because chain-of-title issues and prior dispute history can affect the value and the risk profile of the acquisition.
Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.