Step-by-step: prove a legitimate interest in your .xyz domain

Step-by-step: prove a legitimate interest in your .xyz domain. UDRP and ccTLD domain recovery and defense across .xyz. Email the firm to assess your case.

A UDRP complaint lands in your inbox. The complainant claims your .xyz domain infringes its trademark, demands a transfer, and gives you 20 days to respond. Your domain name is also your project name, your personal brand, or an investment you have held for years. You did nothing wrong. But doing nothing now will cost you the domain.

To prove a legitimate interest in your .xyz domain under the UDRP, a respondent must satisfy at least one of the Paragraph 4(c) safe harbors: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, or making legitimate noncommercial or fair use of it. Because .xyz operates as a generic top-level domain with accredited registrars, the standard UDRP applies in full — the same rules that govern .com disputes before WIPO, the Forum, or the Czech Arbitration Court. The complainant must prove bad faith registration AND use; your job is to build a record that defeats at least one of those three cumulative elements.

This guide walks each step of that process, flags the trap concealed in each one, and closes with a realistic assessment of when an RDNH finding is within reach.

Step 1: Understand what the UDRP actually requires — and what the .xyz zone means for your case

The UDRP applies to .xyz because the .xyz registry operates under ICANN accreditation, and all accredited registrars are bound by the Policy. That is the starting point: there is no separate ".xyz dispute procedure." If you registered your domain with a mainstream registrar, the complainant filed under the standard UDRP, and the same three-element test applies as it would to a .com or .net dispute.

Under Paragraph 4(a) of the UDRP, the complainant must establish all three elements: confusing similarity to a trademark it holds, your lack of rights or legitimate interests, and registration and use in bad faith. The burden on the second element shifts in practice. Once the complainant makes a prima facie showing that you lack rights, the burden moves to you to produce evidence rebutting that case. Panels are clear on this: a bare denial is not enough.

The trap at Step 1 is treating the UDRP as a formality. Respondents who assume a weak complaint will fail on its own frequently lose by default or produce an inadequate response. The filing deadline is fixed. The response window — 20 days from the date the case formally commences — does not pause while you decide whether to engage.

One practical consideration specific to .xyz: the zone is popular with developers, early-stage startups, and individual registrants who chose it for its low registration cost and availability. Complainants occasionally assume that a .xyz registration is inherently suspect — a signal of bad-faith parking. That assumption is wrong, and a well-constructed response demonstrates it clearly. In our practice defending .xyz respondents, we regularly encounter complainants who filed without investigating the registrant's actual use of the domain.

Step 2: Identify which Paragraph 4(c) safe harbor applies to your situation

Paragraph 4(c) of the UDRP provides three non-exhaustive safe harbors that, if demonstrated, establish your rights or legitimate interests. Each maps to a different registrant profile — and each carries its own evidentiary demands.

The first safe harbor protects a registrant who used or made demonstrable preparations to use the domain in connection with a bona fide offering of goods or services before receiving notice of the dispute. "Before notice" is critical. Panels scrutinize whether use began before the complainant's first cease-and-desist letter, before WIPO sent the case-commencement notice, or sometimes before the complaint was filed. What counts as "notice" can be contested. Set the date conservatively: assume it is the earliest moment the complainant communicated a trademark claim to you.

The second safe harbor applies where you — as an individual, business, or organization — have been commonly known by the domain name, even absent a trademark registration. A personal name that matches the domain, an operating business name, a DBA registered before the dispute, or a social media identity built around the string all carry weight. The evidence must connect the name to you, not merely show the name is common in some abstract sense.

The third safe harbor covers legitimate noncommercial or fair use, without intent to mislead consumers or tarnish the trademark. This is the most contested ground. Fan sites, criticism sites, commentary, and genuinely informational portals have all succeeded here — but panels distinguish carefully between a real fair-use purpose and a label applied to a domain that actually diverts traffic for commercial gain.

The trap at Step 2 is assuming one safe harbor will carry the whole response. If the facts support two safe harbors, argue both. Panels assess the totality of the evidence; a secondary safe harbor can rescue a response where the primary argument has a gap.

For an assessment of which safe harbor fits your .xyz situation, contact info@cognomenlaw.com.

Step 3: Build the documentary record before you write the response

A persuasive response is built on documents assembled before a single word of argument is drafted. The panel will weigh what you can show, not what you assert. This step is where most self-represented respondents lose ground that they cannot recover.

For the bona fide use safe harbor, the core record includes: screenshots of the website as it appeared before notice, with timestamps or Wayback Machine captures; invoices, client agreements, or booking records tied to the domain; email correspondence using the domain as a sending address; and any business registration or tax filing that references the entity name matching the domain.

For the "commonly known by" safe harbor, compile: government-issued business name registrations or fictitious-name filings; published articles, directories, or press coverage using the name; social media profiles with the same handle; and any professional affiliation or organizational record that uses the name in connection with the registrant.

For legitimate noncommercial or fair use, document: the site's actual content as published before notice; any editorial policy or about-page statement of purpose; and evidence that no commercial advertising or pay-per-click revenue was generated from the domain during the period at issue.

Cross-cutting all three: WHOIS or RDDS records and registrar confirmations showing the registration date, the registrant's identity, and the unbroken chain of ownership. If the domain was acquired through a private transaction rather than a new registration, preserve the assignment agreement or broker correspondence. Panels have denied transfers in cases where a registrant acquired the domain from a third party in a legitimate market transaction — but only where that chain of title was documented.

The trap at Step 3 is treating assembling evidence as a task to complete after drafting the argument. Reverse it. Gather first. Argue only what the documents support. An argument without a supporting exhibit invites a panel to discount the claim entirely.

Step 4: Address bad faith — and prove the complainant cannot establish it

Proving legitimate interest is one limb of your defense. Defeating bad faith is the other. The UDRP requires the complainant to prove registration and use in bad faith — both, cumulatively. If either limb fails, the complaint should fail.

Panels look at the Paragraph 4(b) factors: whether you registered the domain to sell it to the mark owner at a profit, whether you registered it to disrupt a competitor, whether you are using it to attract users through confusion for commercial gain, or whether you show a pattern of abusive registrations. None of those factors applies to a registrant with a genuine purpose.

What defeats bad faith most consistently? Evidence of registration before the complainant's trademark was filed, evidence of registration without awareness of the complainant's mark, and evidence that the domain was used in connection with a purpose unrelated to the mark are the most powerful. If the complainant's trademark registration postdates your domain registration, say so clearly and provide the registration date from your registrar's records.

Geographic distance matters too. A complainant based in one country holding a mark that is registered only domestically has a weaker argument that a registrant in a different jurisdiction — who had no realistic exposure to that mark — registered the domain in bad faith. Panels apply a "knew or should have known" test to assess whether the registrant was aware of the mark at registration. Make the geographic and market record explicit.

In a recent matter involving a .xyz domain (summer 2025), we defended a registrant who had operated a small online project under the domain for roughly three years before the complaint arrived. The complainant held a regional trademark in a different industry sector. We established that the registrant registered the domain before the complainant's mark was published for opposition, documented three years of genuine use through archived landing pages and client emails, and the panel denied the transfer on both the legitimate-interest and bad-faith limbs.

The trap at Step 4 is conceding bad faith implicitly. Respondents who focus only on their own legitimate interest and ignore the bad-faith analysis leave half the defense unwritten. Panels review both; address both.

To weigh UDRP defense strategy for your .xyz domain, email info@cognomenlaw.com.

Step 5: Assess whether an RDNH finding is realistic — and argue for it if it is

Reverse Domain Name Hijacking is a panel finding that the complainant brought the complaint in bad faith — essentially to deprive a legitimate registrant of a domain the complainant cannot legitimately obtain. The finding carries no monetary penalty, but it is a reputational sanction and a permanent part of the proceeding record.

Panels grant RDNH findings where: the complainant knew it could not satisfy the three UDRP elements but filed anyway; the complainant's trademark postdates the domain registration by a significant margin; the complainant possessed information that should have told it the registrant had legitimate interests; or the complaint was used as leverage in a commercial negotiation that failed. A pattern of abusive filings against the same registrant or the same registrant class strengthens the case.

RDNH is not routinely available. Panels apply a high threshold. A complaint that is weak but sincerely believed does not qualify. The question is whether the complainant — with access to basic WHOIS data, publication records, and the registrant's public use of the domain — could not reasonably have thought it would succeed. If the answer is yes, make the RDNH argument squarely and point to the specific facts that should have stopped the complaint from being filed.

The trap at Step 5 is arguing RDNH defensively, as an afterthought at the end of the response. RDNH works best when it is framed as a natural consequence of the complainant's conduct: the same facts that defeat the complaint — the early registration date, the documented use, the complainant's awareness of that use — also show that the complaint should never have been filed. Build from those facts, not from generic displeasure at being sued.

Step 6: Choose the forum and understand the procedural mechanics

Because .xyz is a gTLD, the complainant may file at any ICANN-approved UDRP provider: WIPO, the Forum, the Czech Arbitration Court (CAC), or the ADNDRC. The complainant chooses the forum; the respondent does not. Understanding where the case was filed matters because procedural rules, panelist pools, and publication practices differ across providers.

If the case is at WIPO, the response must be filed with WIPO's online filing system and comply with WIPO's Supplemental Rules. WIPO accounts for the large majority of all UDRP proceedings, and its published decision record is extensive. If the case is at the Forum, the Forum's own supplemental rules govern. In our practice, we advise respondents to read the applicable supplemental rules before drafting the response — procedural non-compliance, even on formatting, can affect how a panel treats the filing.

Panel composition is another variable. Panels are normally single-member, appointed by the provider. Either party may request a three-member panel; if the complainant requested single but the respondent requests three, the parties generally split the higher three-member fee. For a respondent with a strong case and a legitimate RDNH argument, a three-member panel is sometimes worth the additional cost — three panelists produce a more deliberated decision, and the RDNH standard is applied more rigorously in deliberative settings.

The realistic timeline for a standard UDRP case is approximately two months from filing to decision, absent procedural complications. Extensions are available on application and for good cause, but the window is not a negotiating chip. If you need more time to gather documents, the request must go to the provider promptly, with a substantive reason.

For context on how .xyz defense strategy compares with the mechanics of defending an investment domain in a different zone, see our analysis of respondent defense for .io investment domains.

Step 7: File the response — and know what a panel will actually read

The response is your one opportunity to place evidence and argument before the panel. There is no hearing, no oral argument, and in most cases no supplemental filings unless the panel specifically invites them. What you file is what decides the case.

A well-constructed response leads with the facts that establish legitimate interest, not with procedural objections or complaints about the complainant's conduct. State the safe harbor that applies, identify the supporting documents, and explain how they meet the standard. Keep the argument clean: panels process many cases and respond well to organized, evidence-grounded submissions. Rhetorical length is not a substitute for proof.

Address each element of Paragraph 4(a) in sequence. On element one (confusing similarity), you generally have limited room — if the domain incorporates the complainant's mark, panels will find similarity regardless of added terms. Acknowledge that if it is true and conserve your argument for elements two and three. On element two (legitimate interest), apply the safe-harbor analysis from Steps 2 and 3. On element three (bad faith), apply the analysis from Step 4. The RDNH argument, if you are making it, follows the bad-faith section as a natural extension of the same facts.

Attach exhibits clearly indexed to the arguments they support. A panel should be able to read the argument and immediately locate the corresponding document. Unnumbered or unexplained attachments frequently go unreferenced in the decision — not because the panel ignored them, but because the connection to the argument was unclear.

In a recent .xyz matter (early 2025), we defended a domain investor who had registered an acronym-based .xyz domain as part of a portfolio of generic terms. The complainant held a mark that shared the acronym but operated in a specialized industry. We indexed fifteen exhibits across three safe-harbor arguments, demonstrated that the acronym predated the complainant's mark in public use, and obtained a denial — with the panel noting the documented pre-dispute portfolio context as the decisive factor.

The trap at Step 7 is overfiling. A response padded with repetitive argument and loosely relevant exhibits signals to a panel that the core case is thin. State the points once, clearly, with the evidence. Then stop.

What evidence decides the outcome of a .xyz legitimate-interest defense?

Across UDRP decisions involving gTLD respondents, the evidence that most consistently produces a denial — or an RDNH finding — follows a recognizable pattern. Registration predating the complainant's trademark rights is the single strongest fact. After that: continuous, documented use of the domain for a purpose unrelated to the complainant's business; a business or personal identity that genuinely corresponds to the domain name; and a clear absence of the Paragraph 4(b) bad-faith signals (no solicitation to sell to the mark owner, no pattern of abusive registrations, no commercial use that exploits the trademark's goodwill).

Evidence that panels discount or treat skeptically: a website that appeared only after the complaint was filed; a claim of legitimate use supported only by the registrant's own declaration with no corroborating documents; and post-dispute changes to the site's content or purpose. Credibility matters in arbitration just as it does in court. A submission that appears to have been constructed to match the safe-harbor language, rather than to document what actually happened, rarely succeeds.

The decision matrix for a .xyz respondent looks like this: if the registration predates the complainant's trademark and there is documented use, the legitimate-interest and bad-faith limbs both point toward denial, and the response should be direct and evidence-heavy. If the registration postdates the trademark but the registrant's purpose is genuinely unrelated and well-documented, the focus shifts to the bad-faith analysis — specifically, the absence of awareness and the unrelated nature of the use. If the domain was a speculative registration with no substantive use, the path is harder; the response must then work through the legitimate speculation or fair-use argument with particular care. And if the complainant's mark is geographically limited and the registrant is in a different market, make that geographic distance a central part of the bad-faith analysis.

For a broader view of how due-diligence habits before registration reduce dispute risk, see our analysis on domain due diligence and AI tools.

Related at COGNOMEN

• UDRP respondent defense and RDNH — services across gTLD and ccTLD zones
• Defending an investment domain in the .io zone — strategy and process
• Domain due diligence and AI: what a pre-acquisition search should cover