Protect a brand in a new .dev gTLD launch: what panels actually decide

Protect a brand in a new .dev gTLD launch: what panels actually decide. UDRP and ccTLD domain recovery and defense across .dev. Email the firm to assess your c…

A software company launches its flagship developer tool under a .dev domain, only to discover that an identical string was registered during the sunrise or landrush period by a party with no apparent connection to the underlying technology. The domain resolves to a parking page. A buy-back demand arrives shortly afterward. The question is not whether this is wrong. The question is which legal route gets the name back – and what panels actually require to order it.

Brand owners who need to protect a brand in a new .dev gTLD launch have two principal arbitral tools: the Uniform Dispute Resolution Policy (UDRP), which can order a transfer, and the Uniform Rapid Suspension System (URS), which orders suspension at a higher evidentiary standard. Both apply to .dev domains. A standard UDRP case at WIPO runs about two months and starts at a filing fee of USD 1,500 for a single-member panel. The choice between them turns on the remedy you need and the evidence you hold.

This analysis covers the governing rules and their application in .dev, the divergence between URS and UDRP outcomes, the evidence that decides close cases, the contrary panel positions worth knowing, and the realistic next step for a brand holder or a registrant already in a dispute.

What rules govern .dev, and why does the zone matter?

The .dev registry is a generic top-level domain (gTLD) operated by Google Registry, and like all new-gTLD registries launched under ICANN's 2012 expansion, it is contractually bound to offer both the UDRP and the URS as mandatory dispute resolution mechanisms. Both WIPO and the Forum are available as providers. That contractual architecture means the full body of UDRP jurisprudence – accumulated across more than 80,000 cases over more than 25 years – applies directly to .dev just as it applies to .com.

Why does the specific zone matter at all then? Three reasons. First, .dev carries a technical connotation: panels reading "legitimate interest" arguments will encounter respondents claiming developer-community use or open-source project purposes. Those claims can be genuine. They can also be pretextual. Distinguishing them requires more care than a generic parking-page case. Second, .dev enforces HTTPS: every site served over .dev must present a valid TLS certificate. A parking page with HTTPS still resolves and can still redirect users. Third, .dev sunrise registration rights depend on the Trademark Clearinghouse (TMCH), an ICANN-managed database. A brand owner who did not lodge a TMCH record before the sunrise window may have forfeited the fastest first line of defense – though not the arbitral routes that follow.

In our practice, we regularly advise brand owners who missed the sunrise window and first encounter the problem when a .dev matching their mark appears in active use. The UDRP and URS remain fully available at that stage. What changes is the evidence baseline: there is no sunrise registration record to anchor the bad-faith analysis, so the case is built from trademark registration dates, the respondent's registration date, and use evidence.

How do the three UDRP elements apply to a .dev dispute?

To succeed under the UDRP, a complainant must satisfy all three elements of Paragraph 4(a): confusing similarity to a mark the complainant holds, absence of the respondent's rights or legitimate interests, and registration and use in bad faith. The cumulative requirement on the third element – registration AND use – is the doctrinal point that most often trips brand owners who expect a parking page to be self-evidently enough.

Confusing similarity in .dev disputes rarely produces controversy. Panels treat the gTLD extension as generally non-distinctive; a domain that incorporates a registered trademark verbatim will satisfy element one in almost every decided case. The analysis sharpens where the domain adds a generic descriptor – "devtools-[BRAND].dev", for example – or uses a slight spelling variation (typosquatting). Panels have consistently held that the addition of a dictionary word does not dispel confusion when the mark is the dominant component.

The legitimate-interest element is where .dev disputes diverge from boilerplate cases. A respondent who operates an open-source project with a genuine history of developer use, documented in public repositories before the date of any dispute-related notice, can assert a Paragraph 4(c) safe harbor: bona fide use before notice. Panels have found legitimate interest where the repository commit history substantially predates the complaint and the project has actual contributors. They have rejected the defense where the repository was created after the brand owner's cease-and-desist letter, or where the project has a single contributor and no activity beyond the initial commit.

Bad faith in .dev disputes often turns on passive holding combined with a pattern of registrations. Panels have consistently held – following the logic developed across thousands of cases – that passive holding of a domain incorporating a well-known mark, without any good-faith explanation for the choice of name, can constitute bad faith use even where the domain resolves to a parking page or returns a blank response. The Paragraph 4(b) factors (registration to sell to the mark owner, registration to disrupt a competitor, or registration to attract users by confusion) each appear regularly in .dev disputes, particularly where the domain is listed for sale at a price exceeding documented out-of-pocket costs.

For a read on whether the three UDRP elements are met in your .dev matter, reach us at info@cognomenlaw.com.

URS versus UDRP in .dev: which tool fits which situation?

The URS and the UDRP share the same three-element structure but diverge sharply on remedy and evidentiary standard – and that divergence is decisive in choosing the right route for a .dev brand-protection problem.

The URS requires the complainant to prove its case by clear and convincing evidence, a standard higher than the UDRP's preponderance of evidence. In practice, panels administering the URS in .dev disputes demand that the claim be "clear-cut": a domain that blatantly incorporates a globally recognized mark, with no arguable legitimate use, and evidence of bad-faith intent that is essentially self-evident from the registration record alone. Cases where the respondent can assemble any colorable explanation – a developer project, a regional use, an acronym defense – tend to fail the URS standard even when they would succeed on the UDRP record.

The URS remedy is also categorically different. A URS order suspends the domain for the remainder of the registration term. It does not transfer ownership. The registrant retains the right to renew at expiry, which can negate the practical value of the suspension for a brand owner who needs permanent control. The UDRP, by contrast, orders transfer outright when the complainant succeeds, placing the domain under the brand owner's control immediately upon the registrar's implementation.

Where does URS still make sense for .dev? Speed and cost. Where the evidence is unambiguous – a domain registered the day after a major product launch, resolving to a pay-per-click page using the exact mark, with the registrant offering it for sale in five figures – the URS can produce a suspension order faster and at lower official fees than the full UDRP process. For a brand owner who simply needs the domain to stop resolving while a parallel UDRP complaint is prepared, a URS filing on clear facts can serve that interim purpose.

We have defended registrants in URS proceedings where the complainant chose the URS assuming ease of proof, only to have the proceeding fail the clear-and-convincing standard because the registrant's evidence of legitimate use was more than nominal. The URS is not a lower-risk filing for complainants. A failed URS does not preclude a subsequent UDRP complaint, but it does create a record that a respondent will use to argue the claim is marginal.

The right route depends on the remedy and the evidence. A .dev domain representing a clear-cut infringement with no arguable legitimate use → URS for speed; follow with UDRP if transfer is needed. A .dev domain where legitimate-interest or good-faith arguments are expected from the respondent → UDRP at WIPO or the Forum, where the preponderance standard and the fuller record process provide more traction. A multi-domain abusive registration pattern spanning .dev, .com, and other new gTLDs → a UDRP complaint covering all domains registered by the same holder, which the Rules permit for a single filing.

See also our comparison of the two routes at URS vs UDRP: comparing the remedies for new gTLD disputes, and our overview of the URS and new gTLD dispute resolution service.

What evidence actually decides a .dev dispute?

Evidence, not argument, is what moves panels. Brand owners entering a .dev dispute frequently overestimate the strength of confusing similarity and underestimate how much work the bad-faith limb requires.

The strongest evidentiary package for a complainant combines five elements. First, a trademark registration predating the domain's registration date – ideally by a significant margin, and covering the relevant class. Second, evidence of the mark's recognition among the relevant audience: press coverage, user metrics without specific invention, product documentation, and third-party references. Third, the domain's registration history: the WHOIS/RDDS record at the time of registration, any prior content cached by the Internet Archive, and the registrar's record of when the domain was created relative to the mark's first use. Fourth, current and historical use of the domain: screenshots, certificate records, redirect destinations, and any communication from the registrant offering to sell. Fifth, any pattern of similar registrations by the same registrant in other zones.

Respondents who succeed in defeating .dev transfer complaints typically do so on the legitimate-interest and registration-date elements, not on confusing similarity. The most effective respondent records show: a repository or project predating the dispute by a credible margin, public contributions from multiple independent parties, no evidence of awareness of the complainant's mark at the time of registration, and a consistent price history for the domain (i.e., the domain was not immediately listed for sale following the mark owner's launch).

In a recent matter – a .dev dispute involving a developer-tools brand, spring 2025 – we assembled a complaint record documenting mark registrations in five jurisdictions, a cached parking page containing pay-per-click links to competitor services, and a broker listing with a six-figure asking price published within days of the complainant's product announcement. The panel transferred the domain on all three elements without needing to reach the Paragraph 4(b) illustrative factors by name, because the circumstantial record made the inference of bad faith inescapable.

If a prior filing or response produced a bad outcome, a focused second read of the element-by-element record often finds what was missed. Email info@cognomenlaw.com to discuss.

What is the consensus panel view – and where does the minority position diverge?

Consensus position: panels hearing .dev disputes apply the mainstream UDRP jurisprudence without modification for the zone. The gTLD suffix is treated as non-distinctive; the three-element test is applied as in .com; passive holding combined with a famous or well-known mark creates a strong inference of bad faith. Panels that apply this consensus will transfer a domain when the mark is registered, the domain is identical or confusingly similar, and the respondent offers no credible explanation for choosing that specific string.

The minority or contrary positions that occasionally appear fall into three patterns. The first is a more demanding approach to the bad-faith registration limb: some panels require direct evidence that the respondent was actually aware of the complainant's mark at the date of registration, rather than constructive knowledge inferred from the mark's fame. Under this approach, a brand with strong US recognition but limited global reach might lose the bad-faith registration prong against a registrant who can credibly claim to be outside that recognition sphere. This is the position more likely to appear in panels drawn from jurisdictions where US trademark fame is given less automatic weight.

The second contrary pattern concerns descriptive or functional domains. A .dev domain incorporating a common technical term – "api.dev", "build.dev", "sdk.dev" – that also happens to match a brand owner's mark will draw panel scrutiny about whether the mark itself is distinctive enough to anchor element one. Panels have occasionally found that a weakly distinctive mark does not justify displacing a descriptive-term registration, particularly where the respondent shows documented use of the term in its ordinary meaning.

The third divergence is on the legitimate-interest safe harbor for respondents who are resellers, integrators, or service providers. The UDRP historically recognized a limited safe harbor for authorized resellers meeting the conditions panels have developed over many cases (genuine use of the mark to offer the markholder's goods, no attempt to corner the supply, and disclosure of the relationship). In .dev disputes where the respondent claims to offer services for a software platform, panels have reached opposite conclusions depending on how they weigh the evidence of authorization and the adequacy of disclosure. We have seen complainants lose on this issue where the respondent operated a credible integration business and the domain was used – not simply held – for that purpose.

What does this divergence mean practically? Complainants with marks of moderate fame or marks in a technical niche should not assume element three is a formality. A respondent with a documented technical use – even a thin one – can convert a case that looks easy at the outset into a contested proceeding requiring a fuller evidentiary record. Respondents, for their part, should understand that pretextual developer projects created after notice will rarely survive scrutiny.

How does Reverse Domain Name Hijacking arise in .dev disputes?

Reverse Domain Name Hijacking (RDNH) is a finding by a panel that the complaint was brought in bad faith to deprive a legitimate registrant of the domain. The finding is reputational, not monetary – there is no penalty, no cost award, and no damages under the UDRP or URS. Yet RDNH findings carry real consequences: they signal to future panels that the complainant or its counsel pursued a claim without adequate foundation, and they appear in the public record of every major provider's case database.

RDNH is more likely to be found in .dev disputes than in straightforward cybersquatting cases because .dev attracts sophisticated respondents with documented technical uses. Panels have found RDNH where a complainant filed against a respondent who had held the domain for several years with a publicly visible project, where the complainant was or should have been aware of that project before filing, and where the complaint's confusing-similarity argument relied on an implausible reading of the mark. We regularly advise brand owners to review the respondent's documented use history before filing – not only because an RDNH finding is embarrassing, but because a complaint that fails all three elements can energize the respondent to seek a three-member panel on re-filing, increasing cost and timeline.

In a recent matter (a .dev proceeding, autumn 2024), we were retained to defend a registrant who held a domain corresponding to an open-source library predating the complainant's registered mark by over two years. The complaint was filed without apparent review of the public repository. The panel denied the transfer on all three elements and issued an RDNH finding. The complainant's counsel had not reviewed the commit history. That single omission determined the outcome.

Cross-zone considerations: when the .dev problem is part of a wider pattern

A brand protection problem that surfaces first in .dev is rarely limited to .dev. In our experience, abusive registrations in new gTLDs tend to cluster: the same registrant holds the .com, the .io, the .dev, and several new-gTLD variants simultaneously. That pattern has procedural consequences and strategic implications.

The UDRP permits a single complaint to cover multiple domains when all are registered by the same registrant. Filing a consolidated complaint covering the .com and the .dev in one proceeding at WIPO or the Forum – with a single USD 1,500 filing fee for a single-member panel covering up to five domains – is more cost-efficient than separate filings and presents the panel with the full pattern of conduct. That pattern itself is a Paragraph 4(b) factor: a series of registrations targeting the same mark across multiple zones is among the strongest circumstantial indicators of bad-faith intent.

Where the registrations span a ccTLD – a .de, a .uk, or a .eu – the procedural picture fragments. The UDRP does not govern .de; that dispute runs through the German courts, with a DENIC DISPUTE entry to block transfer during litigation. The .uk would proceed under Nominet's DRS, which applies an "abusive registration" test and reads the bad-faith limb as "registered or used" abusively, a lower bar than the UDRP's cumulative standard. The .eu would run through the ADR.eu platform administered by the Czech Arbitration Court. A brand owner facing a portfolio squatter must therefore coordinate three separate procedures under three different rules simultaneously, each with its own timeline, its own fees, and its own eligibility requirements. We handle that coordination across all three zones; where local court action is needed (as in the .de scenario), we work with local litigation counsel in the relevant jurisdiction.

For analysis of how transfer remedies differ across national procedures, see ccTLD transfer remedies: a cross-jurisdiction analysis.

What brand owners and registrants should do right now

Following WIPO's record caseload in 2025 – approximately 6,282 domain-name cases – the pipeline of new-gTLD disputes continues to grow. .dev filings represent a subset of that volume, but the panel decisions being issued now are building the zone-specific jurisprudential record that will define outcomes for years. Acting early matters.

For brand owners, the immediate checklist has four items. First, audit the TMCH: if you have not lodged your registered marks in the Trademark Clearinghouse, you are not receiving sunrise notifications for future new-gTLD launches. Second, run a current .dev search for your core marks, variants, and product names: the cost of a preventive search is trivially small relative to the cost of a dispute. Third, if you find an abusive registration, document current use immediately – screenshot the resolving page, preserve any cached versions, and record the WHOIS data before any update. Fourth, assess the three UDRP elements against what you know about the registrant: confusing similarity is almost always there; the legitimate-interest and bad-faith analysis requires counsel review before filing.

For registrants who have received a complaint, the critical issue is the response deadline. Twenty days from commencement to file a response is the standard period under the Rules, and it is a hard deadline that cannot be unilaterally extended by the registrant. Missing it means a default, and a default proceeding under the UDRP heavily favors the complainant. The response window is the moment to build the legitimate-interest record, document registration history, and – where the complaint is factually or legally unsound – lay the groundwork for an RDNH finding.

The myth worth dispelling here: many registrants believe that holding a domain for several years creates a presumption of legitimate interest that protects them automatically. It does not. Length of holding is one factor in the analysis. A domain registered in bad faith five years ago is still registered in bad faith. What matters is the purpose at the time of registration and the use (or absence of use) since then – not the duration alone.

Related at COGNOMEN

• URS and new gTLD disputes: suspension, transfer, and the right forum
• URS vs UDRP: comparing remedies and standards for your new gTLD case
• ccTLD transfer remedies: how national procedures differ from the UDRP