Most people who lose a domain name do not lose it to a squatter. They lose it to a renewal notice sent to a mailbox nobody reads any more. The name expires, it runs through the registry's grace and redemption periods, and at the point it is released somebody who watches expiry lists registers it within the minute. Only then does it become a squatting story, and by then it is a negotiation rather than a dispute.
That belongs at the top, because the defences that matter are boring and cheap, and an article that opens with trade mark law has the priorities backwards.
What squatting actually is
Registering a name you have no legitimate interest in, in order to be paid by somebody who does. Both the law in most places and the arbitration process that applies to the generic extensions turn on intent rather than on similarity. Registering acme-plumbing.com because you are a plumber called Acme is not squatting, even if a larger Acme exists. Registering it the week after the larger Acme filed a trade mark is.
Four shapes it takes in practice:
- Typo registration. A name one keystroke away from yours, catching the traffic of people who mistype. Monetised with advertising, or, considerably worse, with a copy of your login page.
- Extension sweeping. Your exact name under extensions you did not take. It costs the holder very little and the whole model needs one sale in a hundred to work.
- Expiry sniping. The case described above. It is the largest category by volume and the only one that is entirely within your power to prevent.
- Anticipatory registration. Somebody watching trade mark filings, company registrations and funding announcements, registering before the announcement reaches anyone else.
The defence that costs almost nothing
- Auto-renew on, and checked rather than assumed. It is a toggle on the domain in the client area. The usual way auto-renew fails quietly is an expired card, so the toggle being on is half the answer and the payment method being current is the other half.
- A contact address you will read, and never one at the domain itself. If the domain lapses, the mailbox lapses with it, and every notice about the lapse is delivered to an address that no longer accepts mail. Use an address at a different domain, and a role address rather than one belonging to whoever happened to set it up.
- Registrar lock on. It stops a transfer request being actioned without the lock being removed first. Turn it off for the few days of a transfer you actually intend, and put it back afterwards.
- Expiry dates in a calendar somebody reads. The same calendar as the insurance renewals, not a reminder in the inbox of a person who left.
- Registrant details that are accurate. Several registries send a verification message to the registrant address and suspend the domain if nobody clicks the link. That is the most common reason a new domain stops resolving in its first month, and it is not an attack, it is paperwork.
A note on identity protection, because it is often recommended as though it were universal. It is available on only a handful of the extensions we carry, since registries differ on what they permit. Where it is not available, the registrant details are in the public record, which is an argument for using a company address and a role mailbox rather than your home address and personal e-mail, rather than an argument for paying for something that cannot be enabled.
Defensive registration, done proportionately
"Register every extension" is advice sold by people who sell extensions. With close to seven hundred of them available, the complete set is not a strategy, it is a subscription with no end date. A proportionate version:
- The exact name in the extension your customers will type, which is usually
.complus the country extension where you trade. - The one or two misspellings a person would genuinely make. Most names have none, and buying the ones nobody would type is pure cost.
- Nothing else until a specific problem appears. Twenty defensive registrations renewed for a decade costs more than almost any dispute would.
The measure that outranks all of them is registering the trade mark. A trade mark is what turns a disagreement about who wanted the name more into a case with a remedy attached, and without one the arbitration route below is very hard to win.
If somebody already holds it
Three routes, in increasing cost.
Buy it. Unromantic, and often the cheapest thing on this page. Before making an offer, look the name up in WHOIS, which is free here and reads from the registry's own RDAP service rather than from a cached list. The expiry date tells you whether you are dealing with a portfolio holder who renews ten years at a time or somebody whose registration runs out in five weeks. Do not enquire from an address that identifies your company, for the obvious reason.
Arbitration. For the generic extensions this is the UDRP, and you have to prove all three of the following: the name is identical or confusingly similar to a mark you have rights in; the holder has no legitimate interest in it; and it was both registered and used in bad faith. All three, not two. The remedy is transfer or cancellation, there are no damages, the filing fee is yours whatever the outcome, and a name registered before your rights existed will usually fail the third limb however irritating its owner is. Country extensions run their own equivalent procedures, with their own rules.
Court. In the United States the Anticybersquatting Consumer Protection Act allows damages; elsewhere it is ordinary trade mark litigation. Slow, expensive, and occasionally the only route available. This is a question for a lawyer who has read your file, not for a hosting article.
The short version
Auto-renew, a contact address that stays reachable, registrar lock, a diary entry, and a trade mark if the name matters commercially. Those five prevent nearly every way a name is actually lost, and they cost less between them than one hour of the alternatives. If you are registering now, registering a domain covers what the registry will ask for, and domain search answers from the registry rather than from a cached list, so a name it reports as free really is free at that moment.