How to prove a legitimate interest in your .app domain

How to prove a legitimate interest in your .app domain. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

A UDRP complaint arrives naming your .app domain. The complainant is a brand owner with a registered trademark, and they want the domain transferred. You registered it years ago, built a product on it, and have never heard of their company. Now you have 20 days to respond — or the panel may decide without you.

To prove a legitimate interest in your .app domain under the UDRP, a registrant must satisfy at least one of the safe harbors in Paragraph 4(c) of the Policy: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, or a legitimate noncommercial or fair use without intent to mislead. The .app zone operates under the standard UDRP administered through WIPO, the Forum, and other accredited providers. The respondent who builds that record early — and builds it correctly — can defeat the complaint and, in appropriate cases, pursue a finding of Reverse Domain Name Hijacking.

This page sets out the legal test, the evidence that decides the outcome, and the realistic next steps for a registrant defending a .app domain.

Why .app domains attract UDRP complaints — and why that matters for your defense

The .app zone was launched by Google Registry in 2018 and became one of the first major new gTLDs to require HTTPS for every site — a technical signal of legitimacy. That same legitimacy draws brand owners to file complaints against .app registrations that touch their marks.

Panels treat .app under the standard UDRP three-element test. Nothing in the .app registry agreement creates a heightened complainant burden or a broader respondent safe harbor. But the .app context matters. A registrant who uses a .app domain to deliver an actual software application, an API, or a developer tool has a materially stronger legitimate-interest case than one who parks it at a pay-per-click page. The zone itself signals intended use. When actual use matches that signal, the evidentiary record becomes coherent and persuasive.

We regularly advise registrants in the .app zone who face complaints from brand owners whose trademark postdates the domain registration by months or years. In those cases, the chronology alone is powerful — but it must be documented and presented correctly. A default response, or no response at all, leaves a panel with only the complainant's narrative.

What does Paragraph 4(c) of the UDRP actually require?

Paragraph 4(c) of the UDRP identifies three non-exclusive circumstances that, if demonstrated, establish a registrant's rights or legitimate interests in the disputed domain. A respondent need only satisfy one. The burden is to produce credible evidence; the overall burden of proof on the second UDRP element rests with the complainant, but panels universally expect respondents to substantiate their position.

The three safe harbors are these. First, before any notice of the dispute, the registrant used or made demonstrable preparations to use the domain in connection with a bona fide offering of goods or services. Second, the registrant has been commonly known by the domain name, even without a registered trademark. Third, the registrant is making legitimate noncommercial or fair use of the domain, without intent to mislead consumers or tarnish the mark.

For .app domain holders, the first safe harbor is most frequently applicable. What does "bona fide" mean in practice? Panels look for genuine commercial activity — not a shell site, not a holding page, not a page whose only function is to monetize the domain's resemblance to a trademark. A real product, real users, a real development timeline. The second safe harbor is relevant where the registrant's business name or personal name corresponds to the domain — incorporation records, trading-name registrations, and consistent public use all contribute to that record. The third is narrowest and most contested; panels rarely accept fair-use claims in commercial contexts without clear evidence of non-confusion intent.

If you have received a UDRP complaint naming your .app domain, the 20-day response window is not negotiable. For a read on whether the three UDRP elements are met in your case, reach us at info@cognomenlaw.com.

How do you build the legitimate-interest record for a .app domain?

Building a legitimate-interest record is a document-assembly task as much as a legal argument. The stronger the documentary foundation, the more a panel can rely on it — and the less the panel must fill gaps with inference in the complainant's favor.

The following categories of evidence are most effective in .app defense proceedings. None of this is a checklist to be completed the week a complaint arrives; the most persuasive records are those that predate the dispute by months or years.

• Pre-dispute use documentation: Screenshots, archived versions of the site (using publicly available archiving services), app-store listings, press coverage, GitHub repository commits with dates, and user-facing documentation all demonstrate that the .app domain was in active use before the complainant's notice of the dispute.
• Registration history and rationale: The date of domain registration relative to the complainant's trademark filing and registration date. If the domain predates the trademark application, that chronology is central to the argument.
• Business identity evidence: Company registration records, trading-name filings, developer agreements, invoices, and contracts showing that the registrant's business corresponds to the domain name.
• Correspondence records: Any prior communication with the complainant — a cease-and-desist letter, an unsolicited purchase offer, a broker inquiry — placed in its correct chronological and factual context.
• Technical use evidence: SSL certificates, DNS records, hosting agreements, and application-traffic data that confirm the domain was genuinely deployed as an application endpoint, consistent with the .app zone's purpose.
• Trademark searches conducted at registration: If the registrant conducted a trademark clearinghouse search or other prior-art review before registering the domain, that contemporaneous record supports the inference of good-faith registration.

In a matter we handled in early 2025 — a .app domain held by a small software developer, with a UDRP complaint filed by a much larger brand owner in an adjacent industry — the developer's GitHub commit history going back two years before the complaint proved decisive. The panel found that the bona fide use safe harbor was satisfied and denied the transfer. The complainant had presented no evidence that the developer had ever targeted its mark.

What evidence actually decides the outcome?

Panels deciding the second UDRP element — legitimate interest — and the third — bad faith — evaluate the totality of the record. There is no single dispositive document. But certain evidentiary patterns recur in decisions that favor the respondent.

Registration predating the complainant's mark is the clearest signal. If you registered the .app domain before the trademark was applied for, it is difficult — though not impossible — for a complainant to argue that you targeted something that did not yet exist. Panels have consistently held that a registrant cannot have registered in bad faith with respect to a mark the complainant did not yet hold.

Active, consistent use is the second pillar. A domain that has been continuously used for a real application, with demonstrable users and ongoing development, tells a coherent story. Contrast that with a domain that was registered, left to resolve to a parking page, and then suddenly populated with content only after a cease-and-desist letter arrived — that sequence is one that panels treat with skepticism.

The correspondence pattern matters too. A registrant who, on receiving the complainant's first contact, immediately offered to sell the domain at an inflated price has, in effect, handed the complainant a bad-faith indicator under Paragraph 4(b). A registrant who responds with a clear explanation of legitimate use, supported by documentation, creates a very different record.

What loses cases? A thin record, a response filed late or not at all, and an inability to explain why this particular name — rather than any other — was selected. Panels are alert to domain names that are exact matches for distinctive marks in highly similar industries, with no plausible independent explanation for the choice. Where the registrant's explanation is implausible, the legitimate-interest defense fails regardless of the safe harbor language.

When is a Reverse Domain Name Hijacking finding realistic?

Reverse Domain Name Hijacking — RDNH — is a panel finding that a UDRP complaint was brought in bad faith to deprive a legitimate registrant of their domain. It carries no monetary penalty; it is a reputational sanction. But it appears in WIPO's publicly searchable decisions database, and it is cited in subsequent disputes as evidence of a complainant's litigation conduct.

Panels find RDNH when the complainant knew or should have known it could not succeed — typically because the registrant's domain predated the complainant's trademark, or because the record plainly established legitimate use that the complainant chose to ignore. Filing a complaint without investigating the registrant's use, filing solely to coerce a sale, or misrepresenting the factual record to the panel are patterns that panels have treated as bad faith on the complainant's part.

Is RDNH automatic when a respondent wins? No. A respondent must affirmatively request it and must give the panel a factual basis. The panel will not make the finding simply because the complaint failed. It requires a showing that the complaint was brought with knowledge of its weakness, or that the complainant abused the procedure.

We have pursued RDNH findings in .app and other gTLD proceedings where the complainant's trademark was younger than the domain, the complainant had previously made an unsolicited purchase offer, and the complaint contained assertions that were directly contradicted by publicly available records. In those cases, the factual groundwork — laid in the response itself — is what enables the panel to make the finding.

For a detailed analysis of when RDNH is realistic and how the request is structured, see our FAQ on seeking an RDNH finding.

If a prior UDRP filing or response produced a bad outcome, a focused review of the record may reveal the element that was missed. Email info@cognomenlaw.com to discuss a second read.

How does .app compare to other zones — and when does the procedure differ?

The right route depends on the zone and the goal. For .app — a gTLD administered under standard UDRP — a respondent mounts a defense through the same forum and the same rules as .com, .net, or any other generic zone. The WIPO filing fee for a single-member panel starts at USD 1,500 on the complainant's side; if the respondent requests a three-member panel, the parties generally split the higher fee of USD 4,000.

Compare that to a .uk domain dispute under the Nominet DRS. The Nominet test is "abusive registration" — the complainant shows rights in a name and a registration or use that is abusive. Critically, the Nominet DRS reads "registered or used" abusively — a lower bar than the UDRP's cumulative "registered and used in bad faith." That structural difference means some .uk defenses are harder than their .com equivalents, and some legitimate-use arguments carry different weight under that standard.

For .eu, the ADR.eu procedure administered by the Czech Arbitration Court (CAC) applies its own rules with a broader definition of "rights" on the complainant side. For .de, there is no UDRP equivalent; disputes proceed through the German courts, with DENIC's dispute entry blocking transfer while litigation runs. If your brand dispute spans a .app and a national ccTLD simultaneously, the procedures, timelines, costs, and remedies diverge substantially. We coordinate those parallel tracks as part of our cross-zone practice — see our analysis on verifying chain of title in European zones for context on how multi-zone disputes are structured.

If the complainant is also pursuing a trademark infringement action in a national court alongside the UDRP complaint, the UDRP panel may suspend or terminate the UDRP proceedings. That outcome depends on the timing of the court filing and the applicable rules. Where parallel proceedings are threatened, the strategic decision about whether to press forward with the UDRP response or seek a voluntary suspension requires careful judgment.

What does it cost to defend a .app domain in a UDRP proceeding?

Cost is the practical question every registrant needs answered before deciding whether to engage counsel. The forum filing fee for a WIPO single-member panel is paid by the complainant — the respondent does not pay WIPO's standard fee for filing a response. The respondent's cost is the cost of preparing and filing the response itself.

Legal fees for a straightforward UDRP respondent defense — a single domain, a clear factual record — commonly fall in the USD 3,000–7,000 range at market rates, separate from the forum fee. That range widens for complex cases: a disputed three-member panel (where the respondent shares the higher fee), a case with voluminous evidence, parallel proceedings in multiple zones, or an RDNH request that requires additional briefing.

For a registrant with a genuinely strong record — a domain registered years before the trademark, actively used, with a clear business rationale — the cost of defense is often a fraction of the domain's market value. For a registrant whose record is thin or ambiguous, the calculus is different. Some registrants conclude, on advice, that settling — whether by negotiated sale or transfer — is more cost-effective than a full defense. We present that analysis plainly; we do not push registrants into proceedings they are unlikely to win.

COGNOMEN publishes transparent fee ranges because this market routinely obscures pricing. For a full picture of our respondent-defense services across gTLD and ccTLD zones, visit our respondent defense and RDNH practice page.

Related at COGNOMEN

• Respondent defense and RDNH — defending domain registrants across every UDRP forum and zone
• FAQ: When and how to seek a Reverse Domain Name Hijacking finding in UDRP proceedings
• Verifying chain of title in European zones — due diligence before and during a domain dispute