How to protect a brand in a new .dev gTLD launch

Your brand is registered. Your product ships. Then a .dev domain matching your name goes live — pointed at a competitor's page, a parking lot, or nothing at all. The question is what the rules actually allow you to do about it, and how fast you need to move.

To protect a brand in a new .dev gTLD launch, you have two primary tools under ICANN's dispute framework: the Uniform Rapid Suspension (URS) system, which can suspend an infringing .dev domain within weeks at a lower cost, and the UDRP, which can transfer the domain outright but runs on a longer timeline. Both are available through WIPO and other approved providers. The right choice depends on how quickly you need relief and whether suspension alone is enough.

This page sets out both routes, the evidence that decides them, the costs, and where the cross-zone picture complicates the decision.

What governs .dev domains — and why it matters for brand protection

.dev is a new generic top-level domain operated by Google Registry, and like all ICANN-accredited new gTLDs it is subject to the full ICANN dispute-resolution suite: the URS for rapid suspension and the UDRP for transfer. That means the same two-track system that applies to .com and .net also applies here — but with one structural difference that shapes every strategy decision.

The URS was designed specifically for new gTLDs. It was not grafted on; it was built in. Where the UDRP transfers a domain, the URS suspends it only — the domain goes dark for the remainder of the registration term, then is available again for registration. If your goal is transfer of the .dev into your brand's portfolio, the URS is the wrong tool for that job.

There is also a Sunrise period at launch, during which trademark owners with verified rights in the TMCH (Trademark Clearinghouse) may register matching domains ahead of the general public. If the launch has already passed and you did not register during Sunrise, you are in the general-availability phase — and the dispute mechanisms are your primary recourse. Missing Sunrise is common. It does not close the door; it changes the path.

In our practice, we regularly advise brand owners who discover a .dev registration only after launch, typically when a monitoring alert fires or a customer flags the URL. The window between discovery and any meaningful harm is narrow. Acting on the correct procedural track from day one avoids wasted time and fees on the wrong filing.

How does the URS work for a .dev dispute — and when should you use it?

The URS requires a complainant to meet a clear and convincing evidentiary standard — a higher bar than the UDRP's preponderance-of-evidence approach — but it delivers a faster outcome and carries lower official fees. A successful URS complaint suspends the domain: the name resolves to an ICANN-prescribed page for the rest of the registration term. It does not transfer the domain to you.

That distinction is critical. If you want the .dev domain in your own portfolio — to control the nameservers, redirect traffic, and hold the name long-term — the URS is not sufficient. It is the right instrument when speed and stoppage matter more than ownership. A brand whose customers are actively being misdirected to a lookalike site has an urgent harm that a URS suspension resolves quickly. A brand that simply wants to hold the domain name going forward needs a UDRP.

The URS filing fee is lower than the UDRP's. WIPO and the Forum both accept URS complaints. The process runs on a compressed timeline — commonly a matter of weeks, not months — because the URS is designed for cases that are, on their face, clear-cut. That is precisely why the standard is higher. Cases with any genuine ambiguity about bad faith or legitimate interest tend to fare better in the UDRP, where the panel has time and procedure to work through the competing evidence.

For a read on whether the three UDRP elements are met in your .dev dispute — or whether the URS is the faster fit — reach us at info@cognomenlaw.com.

When is a UDRP complaint the better tool to protect a brand in a new .dev gTLD launch?

The UDRP at WIPO is the correct route when transfer is the goal and when the record of bad faith, while real, involves any complexity. Under Paragraph 4(a) of the UDRP, you must prove all three elements: that the domain is identical or confusingly similar to your mark, that the registrant has no rights or legitimate interests, and that the domain was registered and is being used in bad faith. All three must be met; a strong showing on two is not enough.

In .dev disputes, the confusing-similarity element is usually not the contested battleground. A .dev domain incorporating a registered mark verbatim — or with a minor typosquat variation — typically satisfies that element without difficulty. The fight is almost always on the second and third elements: does the registrant have any colorable claim to the name, and does the conduct evidence bad faith under Paragraph 4(b)?

Paragraph 4(b) bad-faith indicators panels regularly find in new-gTLD contexts include registration of the domain shortly after a brand's public announcement (suggesting opportunistic timing), a pattern of registering brand-matching strings across multiple new gTLDs, pay-per-click monetization using the complainant's mark, and offers to sell the domain to the brand owner at a price disproportionate to registration cost. None of these is automatically decisive; the panel looks at the full picture.

WIPO's filing fee for a single-domain UDRP complaint starts at USD 1,500 for a single-member panel. A standard case is completed in about two months. If the registrant requests a three-member panel, the fee rises to USD 4,000 and the parties generally split the additional cost. Legal fees for a straightforward complaint are separate and typically run in the market range of USD 3,000 – 7,000, depending on the complexity of the record.

In a recent matter — a .dev typosquat, spring 2025 — we assembled a bad-faith record centered on PPC monetization and the registrant's prior pattern across three new gTLDs, and secured a transfer order for a software brand within the standard two-month window. No supplemental filings were needed; the evidence was documented before the complaint was filed.

What evidence actually decides a .dev brand-protection dispute?

A complaint without a documented evidence record is a statement of grievance, not a legal submission. Panels do not presume bad faith from the fact of registration alone — they require a record. Building that record before you file is the single highest-value step in the process.

The essential evidence package for a .dev complaint includes: proof of your trademark rights (registration certificates, or in the case of an unregistered mark, a substantial body of use evidence), screenshots of the contested domain's live content captured with a timestamp, any correspondence with the registrant (an offer to sell, a demand, a refusal to respond), WHOIS/RDDS data showing registration date relative to your mark's priority date, and any evidence linking the registrant to a pattern of abusive registrations in other zones.

WHOIS data for .dev domains is subject to ICANN's standard privacy/proxy rules, which means the registrant's identity may not be visible in the public record. This does not block a complaint — panels regularly proceed on masked WHOIS data — but it means the identifying evidence shifts to technical indicators: nameserver configuration, the parking or redirect service used, the IP address history of the domain.

One pattern worth flagging: .dev domains carry a built-in HSTS preload — the registry enforces HTTPS. A domain parked at a lookalike SSL-enabled site presents a more convincing phishing surface than a comparable .com parking page, and that heightened harm to users can support the bad-faith finding. We have seen panels give weight to that factual distinction where the technical record was properly assembled.

What weakens a complaint? Any evidence that the registrant had a plausible, pre-dispute reason to register the name: a business name matching the domain, a prior use of the phrase in an unrelated field, a registration date that predates your trademark priority date. The UDRP's Paragraph 4(c) safe harbors exist to protect exactly those registrants. If any safe harbor is colorable, the case belongs in a forum with full procedural rights — a court — not an administrative panel.

To assess the evidence record in your .dev matter and weigh URS against UDRP, email info@cognomenlaw.com.

How do .dev disputes compare across zones — and when does cross-zone strategy apply?

Brand protection in a new gTLD launch rarely stops at a single domain. A registrant who targets your brand in .dev has often registered parallel strings in .com, .net, .io, or a matching ccTLD. Each zone has its own rules, and the strategy across zones should be coordinated, not run as four separate complaints in sequence.

The decision matrix works roughly like this. If the same registrant holds your brand in .com and .dev, a single UDRP complaint can cover multiple domains — provided the holder is the same across registrations. That reduces cost and avoids inconsistent panel findings. If the .com dispute is already underway, filing a separate URS for the .dev is usually counterproductive: you would be arguing the same record in two forums simultaneously, with the risk that a URS panel finds the case too complex for summary suspension and dismisses it without prejudice.

Where the parallel registration is in a ccTLD — say, a .uk or .de matching your brand alongside the .dev — the procedural picture diverges sharply. A .uk dispute goes through Nominet's DRS, which applies a different test ("abusive registration" rather than the three-element UDRP cumulative test) and includes a mandatory free mediation stage. A .de dispute has no UDRP equivalent at all; it proceeds through the German courts, with a DENIC DISPUTE entry to block transfer while the claim runs. Neither of those tracks can be replaced by a UDRP or URS filing, and neither can be filed simultaneously with the UDRP in the same forum.

Cross-zone coordination also matters for timing. A settlement with the registrant on the .com, if it includes a domain transfer, may or may not cover the .dev — that depends entirely on how the agreement is drafted. We have handled matters where a brand owner settled a .com dispute and then discovered the same registrant had retained the matching .dev as a second negotiating position. Coordinating the scope of any transfer or settlement across every zone the registrant holds is essential before any agreement is signed.

In a matter handled in autumn 2024, a brand in the developer-tools sector faced the same registrant across a .com and two new gTLDs including .dev. We consolidated the UDRP complaint to cover all three, documented the pattern across zones as a Paragraph 4(b) bad-faith indicator, and obtained a transfer on all three domains in a single proceeding. The cross-zone coordination reduced both cost and total time compared to three sequential filings.

What is the Sunrise period and what happens if you missed it?

The Sunrise period is a pre-launch registration window, typically lasting 30–60 days, during which trademark holders with validated entries in the Trademark Clearinghouse may register domains matching their marks before the general public. The TMCH validation confirms the mark, and a successful Sunrise registration places the brand owner in the domain before any competing registrant can act.

Missing Sunrise does not eliminate your rights — it eliminates a first-mover advantage. Once general availability opens, any registrant can register any available string, and if your brand name was taken, you are in a post-Sunrise dispute posture. The dispute mechanisms described above are the path forward. The TMCH also feeds a Claims Notice system during and after Sunrise: anyone who tries to register a domain matching a TMCH-listed mark receives a warning, and the brand owner receives a notification. Those notifications are time-sensitive; if a registration proceeds anyway after the Claims Notice, it is strong evidence of bad faith — the registrant cannot later claim ignorance of your rights.

If you missed the .dev Sunrise entirely and had no TMCH entry, the threshold question is whether you had trademark rights at all that predate the registration. A pending application may be enough for confusing-similarity purposes in some UDRP decisions, but registered rights are stronger. Common-law or unregistered rights require a substantially heavier evidentiary showing. The earlier your trademark priority date relative to the domain's registration date, the stronger the element-one foundation.

Is Reverse Domain Name Hijacking a risk when you file to protect a .dev brand?

Yes — and it is a risk that brand owners frequently underestimate. Reverse Domain Name Hijacking (RDNH) is a finding that the complainant brought the case in bad faith, typically to deprive a legitimate registrant of a domain they hold with a genuine claim to the name. The finding is reputational rather than monetary — no damages attach — but it becomes part of the public record and can affect credibility in future proceedings.

RDNH findings occur most often in three fact patterns: the complainant knew or should have known the respondent had a legitimate interest (for example, a generic or descriptive phrase that predates the complainant's trademark); the complainant's trademark was registered only after the domain; or the complaint was filed as a pressure tactic after a failed private purchase negotiation. In all three cases, the panel concludes the complainant used the administrative process as a substitute for legitimate legal proceedings.

In the .dev context specifically, the risk is amplified where the domain string is also a common developer-tool term, a programming language keyword, or an open-source project name. A brand called "Deploy," "Runtime," or "Schema" faces a higher RDNH risk in .dev than a brand with a coined, distinctive mark. The analysis before filing should include a genuine assessment of whether the registrant has a credible Paragraph 4(c) defense — not just whether the complainant has a trademark. We act for respondents facing abusive complaints as well as for complainants, and in our practice, a realistic pre-filing risk assessment almost always changes the strategy in some respect.

Related at COGNOMEN

• URS and new gTLD disputes — full service overview for brand owners and registrants
• URS vs. UDRP in cloud and developer gTLDs — analysis of when each tool applies
• Domain recovery after a failed buyback — when the private purchase route closes

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.