Step-by-step: reverse an unauthorized transfer of a .uk domain

Step-by-step: reverse an unauthorized transfer of a .uk domain. UDRP and ccTLD domain recovery and defense across .uk. Email the firm to assess your case.

You wake up to find your .uk domain no longer resolves to your site. The RDDS record shows a new registrant. Someone — through account compromise, social engineering, or a fraudulent transfer request — has moved your domain without your consent. The clock is already running.

To reverse an unauthorized transfer of a .uk domain, the first priority is a registrar lock request and a formal dispute filed with Nominet within the shortest window possible. Nominet governs all .uk registrations and provides the Domain Resolution Service (DRS) — a distinct procedure from the UDRP — with its own rules, timelines, and evidence standards. The DRS test is not "registered and used in bad faith" but rather whether the registration or use amounts to an abusive registration: the key difference is the word "or," which matters enormously when a domain was registered legitimately and then stolen. A court route sits alongside the DRS and, in certain theft scenarios, moves faster.

This guide walks each step, names the trap hidden inside it, and tells you what evidence decides the outcome.

Why the .uk recovery route differs from a standard UDRP

The Nominet DRS applies a different legal test than the UDRP, and understanding that gap is the first decision a registrant facing theft must make correctly. Under the UDRP, a complainant must prove the domain was registered and used in bad faith — a cumulative standard. The Nominet DRS requires only that the registration or use is an abusive registration, which is a lower bar. That distinction benefits a legitimate brand owner trying to recover a hijacked .uk name, because an unauthorized transferee's mere holding of the domain can satisfy the DRS test even without active misuse.

There is, however, a procedural feature that distinguishes the DRS further. Where the respondent files a response, the parties are automatically directed into a free mediation stage before any expert decision is issued. That mediation creates both an opportunity and a timing risk: a bad-faith transferee may use the mediation window to delay while extracting value from the domain. Know this going in.

The DRS also recognizes reverse domain name hijacking — a finding that a complaint was brought abusively — so both sides carry reputational risk if the facts are contested. In our practice, we regularly advise registrants that the choice between DRS and court is not simply cost versus speed; it is about which route better fits the evidence of how the transfer occurred.

Step 1: Secure the domain at the registrar before anything else

The single most time-sensitive action is contacting your registrar to request an emergency lock or transfer-hold the moment you confirm the unauthorized transfer. This step does not reverse the transfer, but it prevents the domain from moving a second time — to a third party who may be a bona fide purchaser and who will complicate any recovery enormously.

What is the trap hidden in this step? Registrars operate their own abuse or security desks with varying response times and escalation paths. A standard support ticket may sit unread for 24 to 48 hours. Call the abuse line directly if one exists, reference the unauthorized transfer explicitly, and follow up immediately in writing with a timestamped email so the record is clear. If the registrar is unresponsive within a few hours, Nominet itself accepts a direct dispute entry — analogous to the DENIC DISPUTE block for .de — that prevents onward transfer while the complaint is in progress.

Document every communication: ticket numbers, timestamps, the name of every representative you speak to. This record becomes evidence in any DRS proceeding or court action. Gaps in the timeline are used by respondents to argue acquiescence.

Step 2: File a Nominet DRS complaint — and understand the timeline

Once the domain is locked against further transfer, the next step is initiating formal proceedings. The Nominet DRS runs through a defined procedural sequence: complaint submission, a 15-working-day response window for the respondent, and then — if a response is filed — automatic referral to mediation. If mediation fails or the registrant does not respond, the complainant pays the expert fee and the case proceeds to a decision.

Nominet publishes its fees clearly. A summary (undefended) decision costs GBP 200 + VAT. A full expert decision costs GBP 750 + VAT. If the losing party appeals, a three-expert appeal panel costs GBP 3,000 + VAT, and the appeal must be filed within 10 working days of the decision; the appeal panel rarely admits new evidence, so the record built at first instance is decisive.

A reasoned DRS case typically resolves in roughly 8 to 12 weeks from filing to decision, absent complications. That is faster than most court proceedings but slower than a registrar-level reversal if you can achieve one. The trap here is assuming the DRS is automatic or administrative — it is an adversarial proceeding with formal pleadings, and a poorly drafted complaint that fails to establish your rights in the name or the abusive character of the transfer will fail even against a straightforwardly dishonest respondent.

For a read on whether the three elements of an abusive registration are met on your specific facts, reach us at info@cognomenlaw.com.

What evidence does the DRS require, and what decides the outcome?

The DRS requires the complainant to show, first, rights in a name identical or similar to the domain, and second, that the registration or use amounts to an abusive registration. In a theft scenario, the "rights" element is usually straightforward — you registered and used the domain, often for years, before the unauthorized transfer. The harder question is proving the transfer was unauthorized and that the current registrant has no legitimate claim.

The evidence package that wins a .uk theft recovery typically includes:

• Proof of original registration: the original registration confirmation email, RDDS history showing your registrant details, and any invoices paid to the registrar over the domain's history.
• Evidence of the transfer trigger: server logs, login alerts, phishing emails, or support-ticket records that show how the account was accessed without authorization. Screenshots with preserved metadata are more persuasive than memory.
• Timeline documentation: every step from initial compromise discovery to registrar contact to DRS filing, showing no unreasonable delay on your part.
• Trademark or business-name evidence: a UK or EU trademark registration, Companies House entry, or trading history under the name — all of which establish your rights independently of the domain itself.
• Correspondence with the unauthorized transferee, if any: demands for payment, silence, evasion, or continued parking of the domain as a monetized page all go to the abusive-registration element.

What the DRS expert will weigh against you: any failure to secure the account adequately (weak credentials, no two-factor authentication), any gap in the dispute timeline suggesting you knew of the issue and delayed, and any ambiguity about whether the transfer may have been authorized by a third party with access to the account.

In a recent matter — a .uk brand-domain theft, autumn 2025 — we assembled an evidence file spanning three years of RDDS records, login anomaly alerts from the registrar's security log, and a Companies House name-match, and secured a full DRS transfer order without the case proceeding to appeal. The former registrant had held the name for fewer than six weeks before the complaint was filed. Speed of response was material.

When does a court route beat the DRS?

The DRS is the standard path for most .uk disputes, but there are scenarios where an application to the English courts — or, depending on the registrant's location, to courts in another jurisdiction — is the more effective route. The right choice depends on three factors: the need for interim relief, the enforceability of the eventual order, and whether monetary damages matter.

Consider a court route when: (a) the unauthorized transferee is actively using the domain in a way that causes immediate commercial harm — redirecting customers, sending invoices, intercepting email — and you need an interim injunction to stop the harm now, not in eight to twelve weeks; (b) the transferee has already moved the domain to a third-party registrar outside Nominet's direct control, creating an enforcement gap; (c) you also want financial compensation for the period of unauthorized use, which the DRS cannot award — it offers transfer or cancellation only, no monetary damages; or (d) the facts suggest a fraud that a criminal referral to law enforcement should accompany, which a court process documents more formally.

The trap in the court route is cost and complexity. Litigation in the English courts through local litigation counsel in the relevant jurisdiction will be substantially more expensive and slower than a DRS filing in straightforward cases. It is not an automatic upgrade — it is a different tool for a different problem.

The decision matrix in practice: a domain stolen through account compromise, held by an anonymous registrant who is parking it, is a DRS case. A domain hijacked by a known former employee who is now competing with you, who has pointed the domain at a rival site, and who you need stopped by Monday — that is a court case, or at minimum a combined DRS-plus-injunction strategy.

To weigh the DRS against a court action for your case, email info@cognomenlaw.com.

Step 3: Build the chain-of-title record for Nominet and any court

Whether you proceed through the DRS or pursue court action, the document that anchors your case is a clear chain-of-title record demonstrating continuous ownership from original registration to the moment of unauthorized transfer. Many registrants discover at this stage that they lack a complete paper trail — the original confirmation email was deleted, the billing contact was a former staff member, or the domain was managed by an agency that no longer cooperates.

How do you fill those gaps? RDDS historical records, while now limited by privacy rules, can still show registrant-name transitions over time. Registrars maintain internal billing and account records that can be produced under a court disclosure order or, in practice, through a well-framed account-verification request. Internet Archive captures can corroborate that your business operated the domain for years. Email server logs, SSL certificate issuance records, and hosting invoices all contribute to a picture no respondent can easily contest.

The trap: do not assume that because you know the domain is yours, a panel or court will simply accept it. Panels decide on the record presented. A respondent who files a thin but formally adequate response forces the complainant to prove every element with documentary evidence. We have defended registrants in the reverse scenario — brand owners filing DRS complaints against legitimate holders — and the lesson runs both ways: the paper record is everything.

Step 4: Handle the mediation stage strategically

If the unauthorized transferee files a response to your DRS complaint, the case moves automatically into Nominet's free mediation stage. This is not optional. It is built into the procedure, and it happens before any expert is appointed.

Mediation in a theft case can feel counterintuitive — why negotiate with someone who took your domain? The answer is tactical: mediation is the fastest resolution path if the respondent will agree to an immediate transfer, and it costs nothing beyond the time invested. A transfer by consent at mediation is enforceable the same day agreement is reached. A full DRS decision after expert appointment may take several more weeks.

The strategic trap is making concessions during mediation that you did not intend to make permanent — for example, agreeing to a "transfer with compensation" arrangement that effectively rewards the theft. Nominet's mediation is confidential, but any settlement terms you agree to bind you. Enter mediation with a clear position: unconditional transfer, no payment, no delay. If the respondent insists on money, mediation fails, and the expert stage proceeds on the merits.

One further trap: the mediation window is sometimes used by a bad-faith respondent to buy time to further monetize the domain or to locate a buyer. Document the domain's use during the mediation period — parking page revenue, any outbound email sent from the domain's addresses, redirects — because evidence gathered during mediation can go before the expert if negotiations break down.

Step 5: Secure the transfer order and implement it

A DRS expert decision ordering transfer is issued to Nominet directly. Nominet implements the transfer within a short administrative period after the decision unless an appeal is filed within 10 working days. The appeal deadline is firm, and the three-expert appeal panel rarely accepts new evidence — which means that if the respondent appeals, the strength of your first-instance record is what decides the outcome.

Once the transfer is implemented, the domain returns to registrant details you specify. The immediate post-transfer steps matter more than most registrants realize. First, update the registrar credentials immediately: new password, new two-factor authentication, a new contact email that the original compromise cannot reach. Second, audit any DNS changes made during the unauthorized holding period — email routing, MX records, and SSL certificates may have been altered to intercept communications or to maintain some access to traffic. Third, consider whether the period of unauthorized use caused any reputational or technical harm — redirected customer emails, fraudulent invoices sent under your domain — that requires separate remediation or a report to law enforcement.

In a recent matter — a .uk services-company domain, early 2026 — the domain was returned through DRS within ten weeks, but post-transfer audit revealed that MX records had been altered during the holding period to intercept inbound email. The domain transfer was only half the recovery; the email compromise required a separate technical and legal response. Do not declare the matter closed the moment the transfer order arrives.

Related at COGNOMEN

• Court recovery and domain theft services — when arbitration cannot reach the full remedy
• Enforcing a UDRP decision — what happens after the panel orders transfer
• National ccTLD dispute procedures — how zone-specific rules shape your recovery options