How to reverse an unauthorized transfer of a .nl domain

How to reverse an unauthorized transfer of a .nl domain. UDRP and ccTLD domain recovery and defense across .nl. Email the firm to assess your case.

Your .nl domain transferred out of your registrar account overnight. You did not authorize it. Someone gained access to your credentials, spoofed a registrar communication, or exploited a gap in account security – and now the domain sits in a stranger's account, potentially pointed at a fraudulent site. You need to reverse an unauthorized transfer of a .nl domain before the damage compounds.

Reversing an unauthorized transfer of a .nl domain requires acting through SIDN, the registry that governs all .nl registrations, and in parallel escalating to both the losing and gaining registrars. SIDN operates a structured complaint and dispute-entry mechanism distinct from the UDRP; it does not apply the UDRP at all. A court route under Dutch civil procedure is available where the registry process cannot reach – particularly when the current holder contests the reversal. Speed matters: the longer the domain sits in the unauthorized holder's account, the more complex the chain of title becomes.

This page covers the SIDN mechanism, the registrar-lock escalation path, the evidence that drives a successful reversal, and the point at which Dutch court intervention becomes necessary.

What governs .nl domains – and why the UDRP does not apply

SIDN, the foundation responsible for the .nl zone, administers all .nl domain registrations under its own Regulations and does not use the UDRP or any UDRP-equivalent arbitration policy. This is a decisive point: brand owners and registrants who have reversed .com cybersquatting through WIPO will find that the .nl route works entirely differently.

SIDN's role is that of a technical registry. It sets registration rules, operates the zone file, and maintains a dispute-entry system that can block a domain from further transfer while a legal claim is pursued. SIDN does not itself decide ownership disputes on the merits. The body that decides those disputes – if the registrar route fails – is a Dutch court. That means any contested reversal of an unauthorized transfer ultimately requires engagement with the Dutch civil justice system, typically through an application for an injunction (a kort geding, or summary proceedings) or a full civil action.

For registrants outside the Netherlands who have had their .nl domain stolen, this is the first practical hurdle: there is no equivalent of a WIPO complaint to file from abroad that will produce a transfer order. The governing national procedure applies, and Dutch civil procedure governs. We work with local litigation counsel in the Netherlands for court proceedings; the sections below describe how far the registrar and SIDN paths go before litigation becomes necessary.

How does the unauthorized transfer of a .nl domain typically happen?

Account compromise is the most common vector. An attacker obtains the registrar login – through phishing, credential stuffing, or a breach of the registrar's own systems – and uses it to initiate an outbound transfer to a new registrar or to change the registered holder details. Some attacks stop at changing the DNS without transferring the domain; others complete a full registrar change, making the reversal path more complex.

A second pattern involves social engineering directed at the registrar's support team: the attacker impersonates the legitimate holder and persuades customer support to release the domain, reset authentication, or approve a transfer. A third, rarer scenario is an insider threat at the registrar level.

Why does the method matter for reversal? Because SIDN and Dutch courts will require evidence of how the compromise occurred. A documented phishing attack – with email headers, a spoofed communication, and server logs – is substantially stronger evidence than a bare assertion that you "did not authorize" the transfer. We regularly advise clients in the early hours after a theft on exactly what to preserve before it disappears.

Immediately after discovering an unauthorized transfer: do not change passwords yet. Capture screenshots of your account activity log, email alerts, and any suspicious communications first. Evidence created in the first hour is often the evidence that decides the case.

The registrar escalation path – and what it can and cannot do

The first move is to contact your current (losing) registrar in writing, by email with a read receipt, within hours of discovering the transfer. State clearly that the transfer was unauthorized, that you are the legitimate holder, and that you are requesting immediate escalation. Ask for the following in the same message: a record of the transfer authorization, the gaining registrar's identity, and a confirmation of any account changes logged in the period immediately before the transfer.

Most registrars have an abuse team that can act quickly when presented with a credible unauthorized-transfer report. The transferring registrar can initiate a dispute with the gaining registrar through SIDN's inter-registrar channel. SIDN can, on application, place a HOLD status on the domain – effectively locking it from further transfer – while the claim is investigated.

The limit of the registrar path is this: if the gaining registrar and the new account holder dispute the claim, neither the losing registrar nor SIDN can simply reverse the transfer and hand the domain back to you. SIDN does not adjudicate contested ownership. That contest goes to a Dutch court. The registrar path can freeze the domain; it cannot always return it.

A practical timeline: in straightforward cases where the gaining registrar cooperates and the documentation is clear, a registrar-level reversal can happen within days. In our practice, we have seen cooperative reversals completed within a week when the evidence of compromise was delivered quickly and the registrar recognized the pattern. Where the gaining registrar contests the claim, you are looking at weeks to months for a court application.

What evidence is required to reverse an unauthorized transfer of a .nl domain?

Evidence quality determines the speed and success of a reversal. The core evidence bundle covers three things: proof of your prior and legitimate ownership of the domain, proof that you did not authorize the transfer, and documentation of the compromise itself.

Proof of prior ownership typically includes: SIDN RDDS (WHOIS) records showing your details as the registered holder before the transfer; invoices or payment records from your registrar; any trademark or trade-name registrations in your brand corresponding to the domain; and a declaration from you setting out the facts chronologically.

Proof of non-authorization requires showing that no transfer-authorization code (authinfo / EPP code) was generated by you, or that one was generated and used without your knowledge. Your registrar's account log is critical here. If the log shows a login from an unrecognized IP address or device immediately before the transfer, that is strong corroboration.

Documentation of the compromise depends on the attack vector. Phishing emails should be preserved with full headers. If your registrar's systems were breached, any notification from the registrar is relevant. If social engineering of the registrar's support team was involved, records of the fraudulent support interaction are needed.

A Dutch court in summary proceedings will look for a credible, fast-assembled body of evidence showing that the probability of your claim succeeding on the merits is high. The court does not conduct a full trial at the interim stage; it weighs urgency against the apparent strength of your position. Thin evidence delays relief and can result in the interim application being denied, requiring a longer main-proceedings track.

When does a Dutch court action become necessary to reverse a .nl domain transfer?

Court action becomes necessary in three scenarios. First, where the gaining registrar refuses to cooperate with the losing registrar's dispute request and SIDN cannot compel a reversal administratively. Second, where the person or entity in whose account the domain now sits claims to be a legitimate purchaser and resists the reversal. Third, where the domain is being actively used for fraud – redirecting customers, sending phishing emails under your brand – and urgent injunctive relief is the only way to stop the harm quickly.

Dutch summary proceedings (kort geding) are well suited to domain disputes. A court can issue an injunction ordering the current registrant and the registrar to cooperate with a transfer back to you, pending a full determination of ownership. The timeline for a kort geding is measured in weeks, not months. It is substantially faster than main civil proceedings and the threshold is urgency plus a plausible legal basis – both typically met in a stolen-domain scenario.

A second practical tool is SIDN's dispute-entry mechanism. A party with a legal claim to a .nl domain can request SIDN to place a DISPUTE entry on the domain, which blocks any outbound transfer to a third party while the legal claim is resolved. This is not a transfer-back; it is a hold. It prevents the situation from getting worse – a "domain laundering" scenario where the domain is flipped through multiple registrars to defeat a reversal claim. We advise requesting the DISPUTE entry as soon as a court action is contemplated.

In a recent matter (a .nl theft, spring 2025), we coordinated the SIDN dispute-entry application and the kort geding filing in parallel, with local litigation counsel in the Netherlands handling the court filings. The domain was frozen within days of the filing, and the court issued a transfer order approximately five weeks after the action was commenced. The attacker had already attempted a secondary transfer; the DISPUTE entry blocked it.

For an assessment of your .nl domain theft and the fastest available route to reversal, contact info@cognomenlaw.com.

Comparing routes: registrar escalation versus SIDN dispute entry versus Dutch court

The right path depends on how contested the situation is and how much time pressure you face.

Where the transfer was clearly unauthorized and the gaining registrar is willing to cooperate, the registrar-escalation route is fastest and cheapest. Both registrars communicate through SIDN's inter-registrar channel, the domain is placed on HOLD, and the reversal is processed administratively. No court, no formal legal filing. This works in perhaps the simplest cases – uncontested, clear documentation, cooperative registrar.

Where the gaining registrar is uncooperative or the new "holder" claims legitimacy, the SIDN dispute-entry mechanism is the next tool. It freezes the domain and preserves the status quo while you build the legal case. It does not produce a transfer. It buys time and prevents secondary transfers. Cost at this stage is primarily the legal cost of preparing the dispute-entry application; SIDN's own charges for dispute entries are modest.

Where you need the domain transferred back – and particularly where the domain is being actively misused – a Dutch kort geding is the route. It is the only mechanism that can compel a contested transfer. The cost is substantially higher than either of the above paths: Dutch court fees plus the fees of local litigation counsel in the Netherlands, plus COGNOMEN's coordination and strategy work. The timeline, however, is weeks rather than months when the urgency criterion is met.

A cross-zone note: if the same attacker also registered or transferred a .com, .net, or other gTLD version of your brand name, the UDRP at WIPO or the Forum is available for those zones and can proceed in parallel. The UDRP filing fee for a single .com starts at USD 1,500 at WIPO for a single-member panel. That proceeding does not help with the .nl, but it prevents parallel damage. We regularly coordinate multi-zone recovery strategies across gTLD and ccTLD proceedings simultaneously.

Contrast the .nl route with the .uk route as a reference point: Nominet DRS for .uk domains includes a free mediation stage and a formal expert-decision mechanism with published fees, and reaches transfer orders through arbitration without requiring a court. The .nl route has no equivalent arbitration stage – SIDN does not adjudicate; only a Dutch court does. This makes .nl one of the more litigation-dependent ccTLDs for contested reversals.

What happens after the domain is returned to you?

Recovering the domain is not the end of the matter. The period during which the domain was in an unauthorized holder's hands may have generated downstream problems: phishing emails sent under your brand, fraudulent invoices, malware hosted on a site bearing your name, or damage to the domain's reputation in DNS blocklists.

After the domain is returned, the immediate priorities are: restore your DNS records and point the domain back to your legitimate infrastructure; check the domain's status in major email and web reputation databases and initiate delisting requests where it has been blocklisted; review whether the domain's SSL/TLS certificates were issued to the unauthorized holder and, if so, request revocation; and notify any parties who may have received fraudulent communications during the period of unauthorized control.

On the legal side, you may have a civil damages claim against the attacker if identifiable, and potentially against a registrar whose security failure enabled the theft. Dutch law allows a civil damages action in these circumstances. We assess the viability of a damages claim as part of the post-recovery analysis.

We also advise a portfolio audit after any .nl theft. How was the transfer possible? What security gap was exploited? Registrar-level two-factor authentication, registry lock for high-value domains, and a clear authorization policy for domain transfers are the standard mitigations. A domain recovered once without addressing those gaps is a domain at risk of a second attack.

Myth and misconception: "I registered it so it must come back to me automatically"

The most common misconception we encounter is that proving you were the original registrant is sufficient to compel a reversal. It is not. The registrant of record at the time of the claim is the party SIDN recognizes. If the domain has been transferred – even fraudulently – to a new holder, the legal process must establish that the transfer was void or voidable, and must obtain an order (from a court, or cooperation from the registrar chain) to execute the reversal.

Original registration history is strong evidence, but it is evidence in a legal process, not a self-executing right. This is why speed matters so much. The longer the fraudulent holder maintains registration, the more administrative steps have accumulated, and the more complex the reversal argument becomes – particularly if the domain has been re-registered or transferred again to a third party who may claim good-faith acquisition.

A second misconception: "the registrar will sort it out." Registrars will cooperate in clear cases and through their own abuse channels, but they are not adjudicators. They cannot force another registrar to reverse a transfer. Only a court can do that in a contested .nl dispute.

In our practice, we have defended clients on the other side of this equation too – registrants who received a SIDN dispute or a court application based on a claim that later proved unfounded. If you have received such a claim and you are the legitimate holder, the same evidence framework applies: you will need documentation of your own chain of title and the legitimacy of the transfer into your account.

To weigh UDRP against a court action for your case, or to assess the fastest route to recover a stolen .nl domain, email info@cognomenlaw.com.

Related at COGNOMEN

• Court action and domain theft recovery across all zones and forums
• Anticybersquatting litigation and court action for online domain disputes
• Case study: verifying chain of title before a .net domain acquisition