Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints

Summary. This toolkit collects the working papers for recovering a hijacked domain name and for preventing the next theft, each introduced by its purpose, its owner, and when to use it, and each followed by drafting commentary tied to authority. The recovery templates cover a triage worksheet, a demand letter to the losing registrar, an abuse report to the gaining registrar, an evidence-of-ownership declaration, an evidence log, and an outline for a Transfer Dispute Resolution Policy request. The litigation and dispute templates supply UDRP complaint sections written for stolen-domain cases, an in rem ACPA complaint skeleton for the registry's district, and a temporary restraining order motion outline with a proposed order directed at the registry. The prevention templates are a domain portfolio security policy, a web developer domain control clause, a demand letter to a developer holding a client's name, and a buy-back decision record. A running example follows one software company through every paper.

Domain recovery is won on paper. A registrar security analyst decides whether to reverse a transfer by reading a two-page letter and a declaration. A dispute panel decides on a complaint and its annexes. A federal judge decides an ex parte TRO on a declaration and a proposed order. The faster those papers are clear, complete, and supported, the faster the name comes back. This toolkit is those papers.

How to use this toolkit

Each template states its purpose, its owner, and when to use it, followed by the template and drafting commentary. Bracketed text in capitals is to be filled in. Number every exhibit the same way across all papers (E-1, E-2, and so on), so the declaration, the evidence log, the registrar letter, and the complaint all cite the same item by the same number.

The doctrine behind these templates is in Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back. The order of use is in Recovering a Hijacked Domain Name: A Practical Guide, and the task list is in Domain Name Security and Recovery Checklist: A Practical Checklist. For cybersquatting (rather than theft) pleadings, see Domain Name Toolkit: UDRP Complaints, ACPA Pleadings, and Portfolio Management and Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

The running example. Kestrel Lane Software, Inc., a Delaware corporation in Denver, has sold scheduling software under the federally registered mark KESTREL LANE since 2015, at kestrellane.com. The name was registered in 2015 by Ostrander Web Studio, the agency that built Kestrel Lane's first site, in an Ostrander account at a U.S. registrar ("Registrar A"), with the registrant organization listed as Kestrel Lane and the contact email set to an Ostrander address. Ostrander's email account was compromised in [MONTH]. The intruder reset the Registrar A password, removed the lock, obtained the transfer code, and moved kestrellane.com to a registrar overseas ("Registrar B"). The name now resolves to a copy of Kestrel Lane's login page that harvests customer credentials, and it is listed for sale on a marketplace.

Template 1: Hijacking triage worksheet

Purpose: Sort the facts in the first hours and pick the recovery paths. Owner: Counsel, with IT. When to use: Before sending anything to anyone outside the company.

HIJACKING TRIAGE WORKSHEET
Domain: [DOMAIN]                 Date/time discovered: [DATE/TIME, TZ]
Prepared by: [NAME]              Privileged and confidential: prepared at direction of counsel

1. EVENT TYPE (check one)
[ ] DNS records changed; registration unchanged
[ ] Account takeover; no transfer yet
[ ] Transfer pending at losing registrar
[ ] Transfer completed to [GAINING REGISTRAR] on [DATE]
[ ] Expired and re-registered by third party
[ ] Held by former employee / developer / agency: [NAME]

2. ENTRY POINT (best current understanding)
[ ] Registrar credentials phished/reused   [ ] Email account compromise: [ACCOUNT]
[ ] SIM swap / port-out: [CARRIER]         [ ] Lapsed contact email domain: [DOMAIN]
[ ] Registrar support social engineering   [ ] Unknown

3. ROOT ACCOUNTS SECURED?   Email [Y/N, TIME]  Phone [Y/N, TIME]  Registrar [Y/N, TIME]

4. RIGHTS
Registrant of record before theft: [NAME/ORG/EMAIL]
Authority documents needed? [ASSIGNMENT / CONFIRMATION FROM (NAME)]
Matching trademark: [REG. NO. / COMMON LAW USE SINCE (YEAR) / NONE]

5. CURRENT HARM
[ ] Phishing customers  [ ] Payment diversion  [ ] Listed for sale at [URL, PRICE]
[ ] Email interception  [ ] Site down only

6. CANDIDATE PATHS (check all that apply)
[ ] Registrar reversal (Template 2, 3)   [ ] TDRP via losing registrar (Template 6)
[ ] UDRP (requires mark) (Template 7)   [ ] In rem + TRO (requires mark) (Templates 8, 9)
[ ] John Doe / in personam               [ ] Developer demand (Template 12)
[ ] Buy-back (Template 13)

7. NOTICES   Insurer [DATE/TIME, CLAIM NO.]   IC3 [DATE, NO.]   Police [NO.]

Commentary. Mark the worksheet privileged and prepare it at counsel's direction, because it records early judgments about fault (for example, that a vendor's email was the entry point) that may matter in later disputes with the vendor or insurer. Section 4 is the one people skip. If the registrant of record is a vendor or an individual, the registrar may refuse to deal with the company until authority is documented, so start Template 4's authority exhibits immediately. Section 4's trademark entry decides whether Templates 7 to 9 are available: the UDRP and the in rem action under 15 U.S.C. § 1125(d)(2) require a mark.

Running example. Kestrel Lane checks "transfer completed," "email account compromise (Ostrander)," "phishing customers," and "listed for sale." It has federal registration [REG. NO.]. It checks registrar reversal, TDRP, and in rem with TRO, and notes that Ostrander must sign an authority confirmation.

Template 2: Demand letter to the losing registrar

Purpose: Ask the registrar that held the name before the theft to preserve records, contact the gaining registrar through its Transfer Emergency Action Contact, and, if needed, file a TDRP request. Owner: Counsel. When to use: Day 0 to 1, after a phone call to the registrar's security team.

[LAW FIRM LETTERHEAD]
[DATE]
BY EMAIL to [SECURITY/ABUSE ADDRESS] and [LEGAL ADDRESS]

[REGISTRAR NAME], Domain Security / Abuse Team
Re: Unauthorized transfer of [DOMAIN]; your ticket [NUMBER]

We represent [CLIENT], the registrant of [DOMAIN] at [REGISTRAR] from [DATE] until
[DATE/TIME], when the domain was transferred to [GAINING REGISTRAR] without our client's
authorization.

1. What happened. On [DATE/TIME], an unauthorized person accessed [ACCOUNT ID] after
   compromising [EMAIL ACCOUNT / PHONE NUMBER]. The person [changed the account email /
   removed the transfer lock / requested the transfer code] and initiated a transfer that
   completed on [DATE]. Our client did not authorize any of these actions. A declaration
   and evidence index are enclosed (Exhibits E-1 to E-[N]).

2. Requests.
   (a) Preserve all records for account [ID] and [DOMAIN] from [DATE] to present,
       including login records with IP addresses, account and contact changes, lock
       changes, transfer code requests, transfer messages, support contacts, and payment
       records.
   (b) Contact [GAINING REGISTRAR] through its Transfer Emergency Action Contact and
       request reversal of the transfer as unauthorized.
   (c) If reversal is not agreed within [3] business days, file a request under the
       Transfer Dispute Resolution Policy. Our client will prepare the factual record
       and will [reimburse the filing fee].
   (d) Confirm the account is frozen against further changes, and identify any other
       domains in the account that were modified.

3. Our client has reported this matter to the FBI's Internet Crime Complaint Center
   ([NUMBER]). Please direct questions to [NAME, PHONE, EMAIL].

[SIGNATURE]
Enclosures: Declaration of [NAME]; Evidence Index

Commentary. Keep it short and factual. The reader is a security analyst who must decide whether this is a real owner or a second social engineering attempt, so the declaration and evidence index matter more than adjectives. The Transfer Policy requires registrars to maintain a TEAC for urgent registrar-to-registrar communications; the victim cannot invoke it, so the letter asks the registrar to. Paragraph 2(c) anticipates the TDRP, which only registrars may file and which generally must be filed within twelve months of the alleged violation. Offering to prepare the record and cover the fee removes the registrar's two main reasons to decline. Paragraph 2(a) also serves as a preservation demand that will matter if a later subpoena under Fed. R. Civ. P. 45 seeks the logs. Do not threaten the registrar. Registrars are protected for good-faith registration activity under 15 U.S.C. § 1114(2)(D), and you need their cooperation.

Template 3: Abuse report to the gaining registrar

Purpose: Put the gaining registrar on notice and ask it to hold the name. Owner: Counsel or IT. When to use: Day 0 to 2, after or alongside Template 2.

To: [GAINING REGISTRAR ABUSE CONTACT]
Subject: Hijacked domain [DOMAIN] transferred in on [DATE]; phishing in progress

[DOMAIN] was transferred to your registrar on [DATE] without authorization of its
registrant, [CLIENT], after an unauthorized person compromised [ACCOUNT]. The losing
registrar, [REGISTRAR], has been notified (ticket [NO.]) and is contacting your
Transfer Emergency Action Contact.

The domain is currently being used to [host a credential phishing page imitating
CLIENT's login at URL / send fraudulent invoices / offer the domain for sale at URL].
Evidence: [ATTACHED INDEX, E-1 to E-N].

We ask that you (1) place the domain on hold and prevent further transfer or
modification, (2) suspend resolution if the phishing is confirmed, (3) preserve all
records for the account that received the domain, and (4) coordinate with [REGISTRAR]
on reversal.

[NAME, TITLE, PHONE, EMAIL]

Commentary. Lead with the abuse, because accredited registrars must maintain abuse contacts and respond to well-founded reports, and the 2024 amendments to the Registrar Accreditation Agreement added obligations to act on DNS abuse such as phishing. A phishing report gets faster attention than an ownership claim. Keep the tone cooperative: the gaining registrar is often a victim of the same fraud, having accepted a customer who paid with stolen credentials.

Template 4: Evidence-of-ownership declaration

Purpose: A sworn statement establishing prior ownership, lack of authorization, and harm, usable with registrars, dispute providers, and courts. Owner: A client officer with personal knowledge (counsel drafts). When to use: Day 0 to 2; update for court filings.

DECLARATION OF [NAME] REGARDING [DOMAIN]

I, [NAME], declare:

1. I am [TITLE] of [CLIENT] ("Company"). I have personal knowledge of the facts stated
   here or have learned them from Company business records kept in the ordinary course,
   which I have reviewed.

2. Company has used [DOMAIN] continuously since [DATE] as the address of its website and
   email. [Describe use: customers, revenue band, email accounts.]

3. Registration. The domain was registered on [DATE] [by Company / by (VENDOR) on
   Company's behalf] at [REGISTRAR]. Company paid the registration and renewal fees
   (E-[ ]). [If vendor-registered: (VENDOR) confirmed in writing that it registered the
   domain for Company and claims no interest in it (E-[ ]).]

4. Trademark. Company owns U.S. Registration No. [ ] for [MARK] (E-[ ]) and has used
   [MARK] in commerce since [DATE].

5. Unauthorized access. On [DATE/TIME], [describe: alert received, login from unknown
   IP, account email changed]. No one at Company authorized these actions (E-[ ]).

6. Transfer. On [DATE], the domain was transferred to [GAINING REGISTRAR]. Company did
   not request or approve the transfer and did not provide the transfer code to anyone
   for that purpose (E-[ ]).

7. Current use and harm. Since [DATE], the domain [describe phishing/sale listing]
   (E-[ ]). Customers have reported [describe]. Company's email at the domain is
   [interrupted / intercepted].

8. Steps taken. [Registrar contacts, IC3 report, insurer notice, customer warnings.]

I declare under penalty of perjury under the laws of the United States of America that
the foregoing is true and correct. Executed on [DATE] at [CITY, STATE].

[SIGNATURE]

Commentary. The closing language follows 28 U.S.C. § 1746, which lets an unsworn declaration substitute for an affidavit in federal court; a declarant signing outside the United States uses the statute's alternative form. Paragraph 1's business-records foundation helps with authentication under Fed. R. Evid. 901. For a TRO, paragraph 7 carries the irreparable harm showing and paragraph 8 supports the notice certification required by Fed. R. Civ. P. 65(b)(1). Do not overstate what is known about the entry point; say "on information presently available" where the forensic work is ongoing.

Running example. Kestrel Lane's CEO signs paragraphs 1 to 8. Ostrander's principal signs a one-page companion declaration confirming that the studio registered kestrellane.com for Kestrel Lane in 2015, that the studio's email was compromised, and that it claims no interest in the name.

Template 5: Evidence log

Purpose: Track every item of evidence with enough detail to authenticate it later. Owner: Counsel or the forensic vendor. When to use: From the first capture.

Commentary. A hash recorded at collection lets a qualified person certify that a copy is identical to the original under Fed. R. Evid. 902(14), which avoids calling a witness for routine items. Keep the native files (JSON, EML, CSV), not just screenshots. For capture methods, see Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.

Template 6: TDRP request outline

Purpose: Give the losing registrar a ready-made factual record for a Transfer Dispute Resolution Policy filing. Owner: The losing registrar files; counsel prepares the record. When to use: When the gaining registrar refuses or ignores a reversal request, generally within days and always within twelve months of the transfer.

TRANSFER DISPUTE RESOLUTION POLICY REQUEST: OUTLINE OF FACTUAL RECORD
Filing registrar: [LOSING REGISTRAR, IANA ID]
Respondent registrar: [GAINING REGISTRAR, IANA ID]
Domain: [DOMAIN]     Transfer completed: [DATE]     Dispute provider: [PROVIDER]

I.   Relief requested: Reversal of the transfer and return of [DOMAIN] to the filing
     registrar, with registrant data restored to [CLIENT].
II.  Registrant of record before transfer: [NAME/ORG/EMAIL], since [DATE] (E-2).
III. Chronology (table): account access, contact changes, lock removal, transfer code
     request, transfer initiation, transfer completion, TEAC contact and response.
IV.  Why the transfer did not comply with the Transfer Policy:
     A. The transfer was not authorized by the registrant or a person with authority to
        act for it; the person who requested it obtained access through [compromise]
        (Declaration, E-4).
     B. [Any procedural defects: notices sent to an address changed by the intruder;
        change of registrant data immediately before transfer; failure to respond to
        TEAC within the required period.]
     C. Indicators of fraud known to the respondent registrar: [new account, payment
        details, immediate listing for sale, phishing use].
V.   Communications with respondent registrar: [dates, content, responses].
VI.  Exhibits: Declaration; evidence log items [ ].

Commentary. The TDRP asks a narrow question: whether the transfer complied with the Transfer Policy. Frame Part IV around authorization, because a transfer requested by an intruder lacked the registrant's authorization even if the intruder used a valid transfer code. Part IV.B captures any procedural failure, including a missed TEAC deadline, which the policy treats seriously. ICANN's Transfer Policy Review recommendations, approved by the GNSO Council in March 2025, would revise the Transfer Policy and the TDRP once the ICANN Board adopts them and they are implemented; cite the version in force on the transfer date. A TDRP decision may be challenged in court, so build the record as if a judge will read it.

Template 7: UDRP complaint sections for stolen-domain cases

Purpose: Replace the standard cybersquatting narrative with one that explains theft. Owner: Counsel. When to use: When the complainant has a mark and registrar recovery has failed or is too slow; the remaining sections of the complaint follow the provider's model form.

FACTUAL AND LEGAL GROUNDS

A. Background
   Complainant [NAME] has used [MARK] since [YEAR] and owns [REGISTRATIONS] (Annex [ ]).
   Complainant registered the disputed domain name on [DATE] and used it continuously
   for its website and email until [DATE], when it was taken without authorization
   through [method] (Annex [ ], Declaration).

B. Identical or confusingly similar (Policy, para. 4(a)(i))
   The disputed domain name consists of the mark [MARK] and the generic top-level domain
   [.com], which is disregarded for this comparison. [For common law marks: evidence of
   use, sales, advertising, recognition since (YEAR).]

C. No rights or legitimate interests (para. 4(a)(ii))
   Respondent acquired the disputed domain name by unauthorized access to Complainant's
   account on [DATE]. A person who obtains a domain name through theft acquires no
   rights or legitimate interests in it. Respondent has not used the name for a bona
   fide offering; it has used it to [phish Complainant's customers / offer it for
   sale]. Respondent is not commonly known by the name and has no authorization from
   Complainant.

D. Registered and used in bad faith (para. 4(a)(iii), 4(b))
   1. The relevant registration is Respondent's acquisition on [DATE], when Complainant's
      rights in [MARK] were long established.
   2. Respondent acquired the name by unauthorized access, which is itself bad faith.
   3. Respondent's [listing for sale at (PRICE) / offer to Complainant] shows intent to
      sell to the mark owner for valuable consideration in excess of out-of-pocket
      costs (para. 4(b)(i)).
   4. Respondent's use of the name for a page imitating Complainant's login to collect
      credentials is use in bad faith.
   5. Respondent's use of a privacy service and false contact details supports the
      inference.

E. Remedy: Transfer of the disputed domain name to Complainant.

F. Mutual jurisdiction: [Location of registrar / registrant's address as shown in the
   registrar's records].

Commentary. Paragraph D.1 matters: panels following the WIPO Jurisprudential Overview 3.0 generally treat a transfer to a new registrant as a new registration for bad-faith purposes, which is what makes the UDRP fit a theft. The courts are split on the analogous ACPA question (GoPets Ltd. v. Hise, 657 F.3d 1024 (9th Cir. 2011), against; Jysk Bed'N Linen v. Dutta-Roy, 810 F.3d 767 (11th Cir. 2015), for), but the UDRP's own consensus is clear. Section C should not overclaim. If a downstream purchaser holds the name and may answer with a purchase story, say what is known about the chain and why the purchase does not confer rights; panels may decline cases that look like contract or title disputes outside the policy. Annex the declaration (Template 4) and evidence log (Template 5). Filing triggers a registrar lock under the UDRP Rules, which stops further transfers. A respondent who loses may suspend implementation by filing suit within ten business days under paragraph 4(k), and a court will decide the case without deference to the panel, Storey v. Cello Holdings, L.L.C., 347 F.3d 370 (2d Cir. 2003). For general UDRP drafting, see How to File a UDRP Complaint for Domain Name Disputes.

Template 8: In rem ACPA complaint skeleton

Purpose: A complaint against the domain name in the district where the registry or registrar sits. Owner: Counsel. When to use: When the plaintiff has a mark, the person who took the name cannot be found or reached, and speed matters.

UNITED STATES DISTRICT COURT
FOR THE EASTERN DISTRICT OF VIRGINIA
Alexandria Division

[PLAINTIFF],
        Plaintiff,
v.                                          Civil Action No. [ ]
[DOMAIN], an Internet domain name,
        Defendant in rem.

VERIFIED COMPLAINT FOR IN REM RELIEF

NATURE OF THE ACTION
1. This is an in rem action under the Anticybersquatting Consumer Protection Act,
   15 U.S.C. § 1125(d)(2), to recover the domain name [DOMAIN], which was taken from
   Plaintiff without authorization on [DATE] and is being used to [phish Plaintiff's
   customers / offer it for sale].

JURISDICTION AND VENUE
2. Subject matter jurisdiction: 28 U.S.C. §§ 1331 and 1338; 15 U.S.C. § 1121.
3. In rem jurisdiction and venue: 15 U.S.C. § 1125(d)(2)(A) and (C). The registry for
   [.com], Verisign, Inc., is located in this district at [ADDRESS].
4. Plaintiff cannot obtain in personam jurisdiction over, or through due diligence has
   been unable to find, a person who would have been a defendant in a civil action
   under § 1125(d)(1). [Facts: privacy service, false contact data, foreign registrar,
   no U.S. contacts known.] On [DATE], Plaintiff sent notice of the alleged violation
   and its intent to proceed in rem to the postal and email addresses provided by the
   registrant to the registrar (Ex. [ ]), and will publish notice as the Court directs.

PARTIES
5. Plaintiff [description, mark, registrations].
6. Defendant [DOMAIN] is registered with [REGISTRAR B] and recorded in the registry
   maintained by [REGISTRY].

FACTS
7-[ ]. Plaintiff's mark and use; Plaintiff's registration and use of [DOMAIN] from
   [DATE]; the unauthorized access and transfer; current use; harm.

COUNT I: Cybersquatting, 15 U.S.C. § 1125(d)(1)
   Registrant registered, trafficked in, or used [DOMAIN], identical or confusingly
   similar to Plaintiff's distinctive mark, with bad-faith intent to profit. [Plead the
   statutory bad-faith factors that apply: no IP rights in the name; no bona fide use;
   intent to divert or harm; offer to sell; false contact information.]

COUNT II: Infringement and false designation of origin, 15 U.S.C. §§ 1114(1), 1125(a)
   [Use of the domain for a page imitating Plaintiff's services.]

PRAYER FOR RELIEF
A. An order that [REGISTRY] and [REGISTRAR B] transfer [DOMAIN] to Plaintiff by
   changing the registrar of record to [PLAINTIFF'S REGISTRAR], which shall register
   the domain in Plaintiff's name.
B. Pending judgment, an order that the domain remain locked and [its resolution be
   disabled].
C. Such other relief as the Court deems just, limited to that available under
   15 U.S.C. § 1125(d)(2)(D)(i).

VERIFICATION [28 U.S.C. § 1746]

Commentary. Venue and in rem jurisdiction lie only where the registrar, registry, or other domain name authority is located, Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002); for .com and .net, the registry is in the Eastern District of Virginia, and many plaintiffs plead the registry's location even when the registrar is domestic elsewhere. Jurisdiction cites: 28 U.S.C. § 1331 and 28 U.S.C. § 1338. Count II is available in rem because the in rem provision reaches infringement and dilution claims as well as cybersquatting, Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002). Paragraph 4 is the jurisdictional heart of the case: the Fourth Circuit measures the availability of personal jurisdiction at filing, Prudential Insurance Co. of America v. Shenzhen Stone Network Information Ltd., 58 F.4th 785 (4th Cir. 2023), and a registrant's late offer to submit does not undo a proper in rem filing, Porsche Cars North America, Inc. v. Porsche.net, 302 F.3d 248 (4th Cir. 2002). The prayer must stay within the in rem remedies (forfeiture, cancellation, transfer) under 15 U.S.C. § 1125(d)(2)(D)(i); damages are not available. Deliver a filed, stamped copy to the registry and registrar promptly, which triggers their statutory duty to deposit control documents with the court and to leave the name unchanged during the case. In Eastern District of Virginia in rem cases, the default sequence (publication order, entry of default under Fed. R. Civ. P. 55(a), and a motion for default judgment) is well worn; see Default Judgment Toolkit: Entry Requests, Damages Declarations, and Motions to Vacate. Check the court's local rules and current practice on publication before filing.

Running example. Kestrel Lane files against kestrellane.com in Alexandria, pleading Counts I and II and the theft through Ostrander's compromised email.

Template 9: TRO motion outline and proposed order directed at the registry

Purpose: Freeze the name and stop ongoing fraud while the in rem case proceeds. Owner: Counsel. When to use: Filed with Template 8 when the domain is being used to harm customers or is at risk of sale.

MOTION FOR EX PARTE TEMPORARY RESTRAINING ORDER: OUTLINE
I.   Introduction: the theft, current harm, relief sought (lock; disable resolution).
II.  Facts: cite Declaration (Template 4) and Evidence Log (Template 5) by exhibit.
III. Standard: Fed. R. Civ. P. 65(b); Winter factors.
IV.  Argument
     A. Likelihood of success: mark rights; theft as bad-faith registration and use;
        in rem jurisdiction and venue established (Compl. ¶¶ 2-4).
     B. Irreparable harm: loss of control of Plaintiff's domain and email; ongoing
        credential phishing of customers; risk of sale to a third party that would
        complicate recovery; harm to goodwill not compensable in money and not
        recoverable in rem.
     C. Balance of equities: a lock preserves the status quo; the registrant obtained
        the name without authorization.
     D. Public interest: preventing consumer deception and fraud.
     E. Ex parte relief: specific facts showing immediate harm; certification of
        notice efforts (email to registrant address and privacy service on [DATE]).
     F. Bond: nominal bond appropriate; the res is preserved, not destroyed.
V.   Relief requested (see proposed order).

[PROPOSED] TEMPORARY RESTRAINING ORDER
1. Pending further order, [REGISTRY] shall place [DOMAIN] on registry hold and lock,
   preventing transfer, deletion, or modification of the registration.
2. [REGISTRY] shall [disable resolution of DOMAIN by removing its name server records
   from the zone] until further order.
3. [REGISTRAR B] shall not transfer, delete, or modify the registration.
4. Plaintiff shall serve this Order by email on the registrant's contact address and
   the privacy service, and on [REGISTRY] and [REGISTRAR B] by [method].
5. This Order expires at [TIME] on [DATE, 14 days] unless extended. A hearing on a
   preliminary injunction is set for [DATE].
6. Plaintiff shall post a bond of $[ ].

Commentary. Address each factor from Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008), and anchor the ex parte request in Rule 65(b)(1)'s two requirements: specific facts in a declaration showing immediate and irreparable injury before the adverse party can be heard, and counsel's written certification of efforts to give notice and why it should not be required. The order must state the injury, why it is irreparable, and why it issued without notice, and it expires in fourteen days unless extended for good cause, Fed. R. Civ. P. 65(b)(2); a TRO that outlives its term without extension is treated like a preliminary injunction, Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (1974). Directing relief at the registry rests on the court's in rem control of the name and the registry's statutory duties under section 1125(d)(2)(D); if a court questions its authority over a nonparty registry, the statute's deposit and non-modification provisions and 28 U.S.C. § 1651 supply the answers. Disabling resolution is stronger medicine than a lock; request it only when the domain is actively used for fraud and the declaration proves it. Registries comply with clear orders, and the Lanham Act protects registrars and registries that act under a court order, 15 U.S.C. § 1114(2)(D). For a general TRO checklist, see Preliminary Injunction and TRO Application Checklist: A Practical Checklist.

Template 10: Domain portfolio security policy

Purpose: A short internal policy that makes the prevention controls mandatory and assigns owners. Owner: Legal and IT, approved by management. When to use: Adopt now; review annually and after any incident.

[COMPANY] DOMAIN NAME SECURITY POLICY
Effective [DATE]     Owner: [ROLE]     Review: annually

1. Scope. All domain names registered, used, or controlled by [COMPANY] or its
   subsidiaries, including names registered by vendors on [COMPANY]'s behalf.

2. Ownership. Every domain shall be registered with [COMPANY] (or the applicable
   subsidiary) as registrant organization, in a registrar account owned by [COMPANY].
   No domain may be registered in an employee's or vendor's personal or business
   account. Existing exceptions must be remediated by [DATE].

3. Inventory. [ROLE] maintains the domain inventory (registrar, account, registrant,
   contacts, expiration, locks, DNS host, criticality tier) and reviews it quarterly.

4. Registrars. Domains are held only at approved registrars that support hardware-key
   or passkey authentication, role-based account access, and registry lock where the
   registry offers it. Approved registrars: [LIST].

5. Access control.
   a. At least two named administrators; no shared credentials.
   b. Phishing-resistant multifactor authentication required; SMS and voice codes
      prohibited as factors or recovery methods.
   c. Registrant and account email: [ROLE ADDRESS]@[COMPANY DOMAIN].
   d. Access removed on the day of an administrator's departure.

6. Locks. Registrar lock on all domains. Registry lock on all Tier 1 domains where
   available. Lock status verified quarterly by RDAP lookup.

7. Renewals. Auto-renew on all retained domains with a corporate payment method and a
   backup. Tier 1 domains registered for the maximum term available. Failed renewal
   charges escalated within one business day.

8. DNS. Changes to name servers and mail records require [approval]. DNS monitoring
   and alerts enabled. Dangling records reviewed quarterly. DNSSEC enabled where
   supported.

9. Vendors. Vendors with registrar or DNS access must meet sections 5 and 8 and sign
   the domain control clause (Template 11).

10. Retiring domains. Before a domain is allowed to lapse, [ROLE] confirms that no
    account, system, or contact record uses an email address on it.

11. Incidents. Suspected unauthorized access, contact change, or transfer is a
    security incident under [INCIDENT RESPONSE PLAN]. The domain incident playbook is
    maintained by [ROLE] and kept in printed form.

12. Exceptions. Written approval by [ROLE], with a remediation date.

Commentary. Sections 2, 5(b), 5(c), and 10 address the weaknesses behind most thefts: individual or vendor ownership, SMS-based authentication, and registrant email on a domain that could lapse. Section 6's registry lock is the single most effective control, because a thief with the customer's credentials cannot remove server-level statuses. If the company is subject to a security program requirement (for example, the FTC Safeguards Rule for financial institutions or state data security laws), fold this policy into the written information security program. See Cybersecurity Program Toolkit.

Template 11: Web developer domain control clause

Purpose: Make clear in every vendor agreement that the client owns its domains and can get them on request. Owner: Legal. When to use: Every web development, agency, hosting, marketing, and IT services agreement.

[X]. Domain Names and Accounts.
[X].1 Ownership. All domain names registered, renewed, or managed by Vendor for Client
      or for use in the Services ("Client Domains") are the property of Client. Vendor
      shall register each Client Domain in Client's name as registrant, in a registrar
      account owned and controlled by Client, unless Client directs otherwise in
      writing. Any Client Domain that Vendor holds in its own name or account is held
      by Vendor as Client's agent and for Client's sole benefit.
[X].2 Credentials and Security. Vendor shall access Client's registrar and DNS accounts
      only through individual named credentials protected by phishing-resistant
      multifactor authentication, shall not change registrant or account contact data
      without Client's written approval, and shall notify Client within [24] hours of
      any suspected unauthorized access to any account that controls a Client Domain.
[X].3 Transfer on Request. Within [2] business days after Client's written request,
      and in any event on expiration or termination of this Agreement, Vendor shall
      transfer each Client Domain held in Vendor's name or account to the registrant
      and account Client designates, provide all authorization codes, remove any locks
      it controls, and take all other steps reasonably necessary to complete the
      transfer.
[X].4 No Retention as Security. Vendor shall not withhold, suspend, redirect, or
      condition the transfer of any Client Domain on payment of any amount, including
      amounts in dispute. Any fee dispute shall be resolved under Section [DISPUTES].
[X].5 Cooperation in Recovery. If a Client Domain is transferred, modified, or accessed
      without authorization, Vendor shall cooperate in its recovery, including by
      providing records and signing declarations as to the facts within its knowledge.
[X].6 Power of Attorney. Vendor appoints Client as its attorney-in-fact, coupled with
      an interest, to execute documents and instructions necessary to transfer any
      Client Domain if Vendor fails to do so within the period in Section [X].3.
[X].7 Survival. This Section survives expiration or termination.

Commentary. Section [X].1 does the work that copyright's work-made-for-hire rules cannot. Those rules define authorship of copyrightable works under 17 U.S.C. § 101 and 17 U.S.C. § 201, and a domain registration is not a work of authorship; ownership of the registration depends on the registrant record, contract, and agency principles. Stating that a vendor-held name is held as the client's agent aligns the contract with the Restatement (Third) of Agency's rules on an agent's duties regarding the principal's property. Section [X].4 removes the most common source of disputes. Section [X].5 supplies the companion declaration that a registrar or court will want when the vendor's account was the entry point, as in the running example. Section [X].6 gives the client a document to show a registrar if the vendor disappears; registrars differ on whether they will act on it, so treat it as support, not a guarantee. For the copyright side of the same vendor relationship (the site code and content, where work-made-for-hire and assignment rules do apply), see Work Made for Hire Determination Checklist: A Practical Checklist.

Template 12: Demand letter to a developer or agency holding a domain

Purpose: Recover a client domain held by a current or former vendor. Owner: Counsel. When to use: When a vendor has not transferred a domain on request, or ties transfer to payment.

[DATE]
[VENDOR NAME AND ADDRESS]
Re: Transfer of [DOMAIN] to [CLIENT]

We represent [CLIENT]. In [YEAR], you registered [DOMAIN] for [CLIENT] in connection
with your engagement under [AGREEMENT / proposal dated (DATE)]. [CLIENT] has paid the
registration and renewal fees (enclosed) and has used the domain as its business
address since [YEAR]. [Section (X) of the Agreement provides that (quote).]

You registered and hold the domain as [CLIENT]'s agent. Please transfer it to the
registrant and account identified below, and provide the authorization code, by
[DATE, 5 BUSINESS DAYS]:
   Registrar: [ ]   Account: [ ]   Registrant: [CLIENT LEGAL NAME]

We understand you have raised [an invoice dated (DATE) for $(AMOUNT)]. That matter is
separate from ownership of the domain. [CLIENT] will [pay the undisputed portion of
$( ) / deposit the disputed amount with (ESCROW)] upon completion of the transfer,
without prejudice to either side's position on the invoice.

Withholding a client's domain to obtain payment exposes the holder to claims for
breach of contract, breach of fiduciary duty, and conversion, and, where the domain
matches a client's mark, to claims under the Anticybersquatting Consumer Protection
Act. [CLIENT] prefers to resolve this cooperatively. Please contact me at [ ].

[SIGNATURE]

Commentary. The letter separates ownership from the fee, which is usually what the vendor needs to hear. Conversion is available where the governing state treats domain names as property, as California does after Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003); Virginia's approach in Network Solutions, Inc. v. Umbro International, Inc., 529 S.E.2d 80 (Va. 2000) treats a registration as a contract for services in the garnishment context, so check the governing law before relying on conversion. The ACPA reference is accurate only if the domain matches a distinctive mark and the facts suggest bad-faith intent to profit, such as an offer to transfer for financial gain without bona fide use under 15 U.S.C. § 1125(d)(1); delete it otherwise. Avoid threats of criminal prosecution to gain advantage in a civil matter, which many state ethics rules restrict. For broader ownership disputes, see Brand Ownership Toolkit: Assignment Agreements, Founder IP Clauses, and Ownership Evidence Files.

Template 13: Buy-back decision record

Purpose: Document a decision to pay for the return of a domain, and the safeguards taken. Owner: Legal, finance, and (where coverage applies) the insurer. When to use: Before any payment to a holder of a stolen or disputed domain.

Commentary. A payment to a person on a sanctions list can violate regulations administered by the Office of Foreign Assets Control regardless of intent, including the cyber-related sanctions at 31 C.F.R. Part 578, with reporting obligations at 31 C.F.R. Part 501. Screening an anonymous seller is imperfect, which is why the record also captures the alternatives, the insurer's consent, and law enforcement contact. The structure tracks the ransomware payment analysis in Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates. Escrow mechanics are covered in Escrow Toolkit: Escrow Agreements, Joint Instructions, and Claim Notices.

How the running example ends

Kestrel Lane sent Templates 2 and 3 on the first day. Registrar B placed the name on hold but would not reverse without a decision or order. Registrar A agreed to file a TDRP request using Template 6. Because customers were being phished, Kestrel Lane filed Template 8 in the Eastern District of Virginia with the Template 9 motion on day four. The court entered a TRO the next day, and Verisign locked the name and removed it from the zone. Notice was published, no one appeared, and default judgment ordering transfer entered eight weeks later. Registrar A withdrew the TDRP request.

Kestrel Lane then adopted Template 10, moved its 11 domains into one company-owned account with registry lock on its two primary names, and amended its agency agreement with Template 11. Ostrander signed the amendment without objection. Kestrel Lane's insurer covered most of the forensic and legal costs.

Deadline tracker

Frequently asked questions

Can the victim file the TDRP request itself? No. Only registrars may file. Template 6 exists to make the registrar's decision easy.

Do we need a verified complaint for in rem? Not always, but verification under 28 U.S.C. § 1746 lets the complaint double as evidence for the TRO and default judgment.

What if the domain is a country-code name? Templates 2 to 6 adapt with the registry's own procedures in place of the ICANN policies. The in rem action is available only where the registrar, registry, or domain authority is in a U.S. district.

Should we sue the person instead? If you can identify and reach the person, yes: in personam claims for conversion, the CFAA, the Stored Communications Act, and the ACPA offer damages that in rem cannot. The John Doe route is in John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.

Will the registrar honor the developer clause's power of attorney? Some will, some will not. The clause is most useful as evidence of ownership and as leverage in a demand.

Practical takeaways

• Use one exhibit numbering system across every paper.
• Lead registrar communications with facts and evidence, not threats.
• Lead gaining-registrar reports with the abuse (phishing, fraud), which gets faster action.
• Build the TDRP record around lack of authorization.
• In the UDRP, treat the thief's acquisition as the bad-faith registration and do not overclaim facts.
• File in rem where the registry sits, stay within in rem remedies, and deliver the complaint to the registry.
• Pair in rem with a narrow TRO and calendar the fourteen days.
• Fix ownership and authentication in vendor contracts before the next incident.

This document is general information, not legal advice for any particular situation; templates must be adapted to the facts, the current ICANN policies, and the local rules of the court.

Related Documents

Related Articles

• Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back: the doctrine and cases behind these templates.
• Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking: in rem and country-code background.
• Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers: the payment analysis behind Template 13.
• Paid Vulnerability Disclosure and the Line Between Research and Extortion: distinguishing a researcher's report from an extortion demand about your domains.
• Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account: ownership, impersonation, and squatting disputes over social media accounts and handles.

Related Guides

• Recovering a Hijacked Domain Name: A Practical Guide: when and in what order to use each template.
• Recovering a Domain Name: A Practical Guide: other domain loss scenarios.
• Identifying an Anonymous Defendant Online: A Practical Guide: naming the person behind a theft.
• Recovering or Defending a Social Media Account or Handle: A Practical Guide: ownership, impersonation, and squatting disputes over social media accounts and handles.

Related Checklists

• Domain Name Security and Recovery Checklist: A Practical Checklist: the task list these templates support.
• Preliminary Injunction and TRO Application Checklist: A Practical Checklist: the emergency filing.
• Vulnerability Disclosure Program and Safe Harbor Checklist: A Practical Checklist: a channel for outside reports about DNS and registrar weaknesses.
• Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist: ownership, impersonation, and squatting disputes over social media accounts and handles.

Related Toolkits

• Domain Name Toolkit: UDRP Complaints, ACPA Pleadings, and Portfolio Management: cybersquatting-oriented UDRP and ACPA forms.
• Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses: URS and reverse hijacking papers.
• Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates: sanctions screening and notification forms.
• Global Trademark Portfolio Toolkit: Filing Matrices, Bad-Faith Registration Responses, and Watch Programs: trademark coverage that opens the UDRP and in rem paths.
• Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters: ownership, impersonation, and squatting disputes over social media accounts and handles.