When to Retain an Expert in a Domain Dispute

By Bill Hartzer, domain name expert witness·August 10, 2026

The deadlines are not the ones on the schedule

In most litigation, timing is set by the court's calendar. In a domain matter it is set by retention windows at third parties who are not in the case, do not know it exists, and delete on schedule.

That inverts the usual sequence. The material that identifies who controlled a domain, and how an account was accessed, sits with registrars and hosting providers under obligations measured in months. The material that shows what a site displayed sits with a third-party archive that crawls on its own schedule. The material that shows what a name resolved to sits with sensor operators whose coverage depends on who chose to contribute data and when.

None of that waits for pleadings to close. The practical question for a retaining attorney is therefore not "is this matter ready for an expert" but "what is expiring while the decision is being made". Capturing the publicly available record is cheap, can be done before any filing decision is made, and is the one step that cannot be performed retroactively.

Every procedural point below is a description of what published policy and rules say. What to serve, when, and on whom, is for counsel.

The clocks that run without notice

These are floors published in policy, not estimates:

Fifteen months — the minimum a registrar must retain the data elements needed for transfer disputes after its sponsorship of a registration ends, under ICANN's Registration Data Policy effective 21 August 2025.
Two years — the outer edge of the 2013 Registrar Accreditation Agreement's record obligation, running from a registration's deletion or transfer away to another registrar. After that a registrar is not obliged to hold registration records at all.
One hundred and eighty days — the short-window category in the associated data-retention material, covering log files, billing records and communication source and destination data. This is the category that would show how an account was accessed.
Twelve months — the window for filing a transfer dispute after an alleged violation of the Transfer Policy.
Five calendar days — the period in which a registrar must produce a copy of the Form of Authorization on a losing registrar's request.

Two further points. Retention floors can be waived: ICANN has granted registrar-specific data-retention relief, so retention is registrar-specific rather than uniform. And hosting, DNS and authentication logs sit outside all of this, on windows each provider sets for itself.

Before a demand letter goes out

The single most avoidable loss in a domain matter happens between the decision to send a demand and the sending of it.

Notice changes behavior. A website can be rewritten the same day. A redirect is configuration and can be removed in seconds, leaving no residue on the domain itself; once removed, a redirect that was never captured is generally unrecoverable. A parking page's advertising rotates per visit. Registration contact details can be edited. None of that is exotic; it is the ordinary reaction to receiving a letter.

The state of the site before notice is also independently important in an administrative proceeding, because one of the enumerated circumstances demonstrating a domain holder's rights or legitimate interests turns on use, or demonstrable preparations to use, the name before any notice of the dispute. That is a dated documentary question for both sides, and the pre-notice state is the thing that stops being observable first.

Capture before the letter goes out. It costs a day and it is not repeatable afterwards.

Before filing a UDRP or URS

Both administrative proceedings compress the evidentiary record into a short, fixed window, and neither has discovery.

In a UDRP, the provider requests registrar verification and a lock, and within two business days the registrar supplies full registration data and confirms the lock. That verification response is frequently the first point at which the party behind a privacy or proxy service is identified, and it is a record that exists nowhere else. A complainant's technical work is usually re-run against it.

What the lock does not do is the part most often misread. By its own definition it prevents modification of the registrant and registrar information; it does not affect resolution of the domain name. The website, the DNS records and any redirect remain changeable throughout the proceeding.

The URS is tighter still: a response is due in fourteen calendar days rather than twenty, the complaint carries a hard explanatory word cap, and the standard of proof is clear and convincing evidence, with the Procedure directing that a complaint be denied where there is any genuine contestable issue as to bad faith. There is no time to collect anything after filing.

The ten-business-day window

US-specific in its practical effect, but the mechanism is contractual and applies across generic top-level domains.

Under the UDRP, where a decision requires transfer or cancellation, the registrar waits ten business days after being informed before implementing it, and will not implement if it receives official documentation that a lawsuit has been commenced against the complainant in a jurisdiction to which the complainant submitted (UDRP, paragraph 4(k)). Separately, the Policy bars transferring the registration to another holder during the proceeding and for fifteen business days after its conclusion.

An expert engaged inside that ten-day window is working in days, not weeks, and the work is necessarily triage: capture the current state of the record before anything moves, preserve the proceeding's own artifacts, identify which custodians hold what and what their windows look like, and document the registration status and lock codes as they stand.

Whether to file anything, where, and on what basis, is entirely counsel's decision. This paragraph describes a published deadline; it is not advice about meeting it.

When an expert probably is not needed

It is worth saying plainly, because the alternative is an engagement that produces nothing counsel could not have produced.

Where the disputed name is identical to a registered mark, resolves to an obvious copy of the mark owner's site, and the registrant is named openly in the public record, the technical record may be short and self-explanatory. Where the entire question is legal — the scope of trademark rights, whether a forum has jurisdiction, whether a claim is timely — a domain expert adds nothing, and an expert who opines there is doing the wrong job.

Where the fame or strength of a mark is the issue, the relevant evidence is trademark-side and survey-side. A domain expert can document a mark owner's own online footprint over time from archives, resolution history and certificate records, and should stop there.

The engagements where the work carries weight are the ones where identity is obscured, dates are contested, a set of names rather than one name is at issue, a redirect or monetization chain is central, or a record has to survive being tested by an opposing technical witness.

What early engagement cannot fix

Speed helps, but it does not create records that were never made.

If a domain was registered after 2018 and never had a public identity record, there is no historical observation to recover; the identity has always been behind the registrar. If passive DNS sensors never observed a low-traffic name, no vendor's archive contains its resolution history, and the absence proves nothing either way. If a web crawler never reached a page — because nothing linked to it, because robots.txt blocked it, or because the content required a login — there is no capture to retrieve, and later requests for exclusion can remove captures that once existed.

Hosting access logs that have already rotated are gone; a preservation letter sent afterwards preserves nothing, and no ICANN policy obliges a registrar to preserve records because a private party asked. In the United States, the statutory preservation mechanism that compels a provider to hold records pending process is addressed to requests by a governmental entity, which makes it unavailable as a civil tool. That point is US-specific.

Early engagement changes what is still capturable. It does not reach backwards.

Frequently Asked Questions

How early is too early to bring in a domain expert?

There is effectively no such thing, because the first task — capturing what is publicly available and hashing it — is useful whether or not the matter proceeds, and is the only step that cannot be done later. Public capture can be completed before a demand letter is drafted and before any decision about a forum. What benefits from waiting is the analytical work, which needs the question to be settled first, since the same captures are organized very differently for an administrative proceeding and for court.

What happens to the evidence when the other side receives notice?

In practice, the observable state can change immediately. Website content can be replaced, redirects removed, DNS records repointed, parking configurations changed and registration contact details edited. In an administrative proceeding a registrar lock prevents modification of registrant and registrar information but expressly does not affect resolution of the domain, so the site and the DNS remain changeable throughout. The pre-notice state is the material most likely to be lost and the most difficult to reconstruct.

Do preservation letters actually stop a retention clock?

Not automatically. Nothing in ICANN policy obliges a registrar to preserve records because a private party asked, and provider retention windows run on their own schedule. A preservation request puts the custodian on notice and is worth sending early and specifically — naming the domain, the date range and the categories of record — but it is a request, not a freeze. The reliable step is capturing what is publicly available immediately, because that does not depend on anyone else's cooperation.

Which records disappear first?

Live state disappears fastest: DNS answers, page content and redirect configuration can change in minutes and leave no residue on the domain. Provider access, authentication and session logs are next, on windows each provider sets, commonly short. Registration and account records last longest, bounded by retention floors of fifteen months after sponsorship ends and an outer edge of two years after deletion or transfer away. Registry records and third-party archives are the most durable, and the least likely to contain identity.

Is the ten-business-day window after a UDRP decision a real constraint?

It is a published one. Where a decision requires transfer or cancellation, the registrar waits ten business days after being informed before implementing, and will not implement if it receives official documentation that a lawsuit has been commenced against the complainant in a jurisdiction to which the complainant submitted. Any expert engagement starting at that point is triage: capture the current record state before anything moves. What is filed, where, and whether anything is filed at all, is for counsel.

Can an expert reconstruct evidence that was not preserved?

Sometimes partially, from independent third-party sources: web archives, certificate transparency logs, passive DNS and commercial registration-data history. Each has documented coverage gaps, and each records something narrower than what was lost — a capture shows content was retrievable by a crawler, a certificate entry shows control was demonstrated to a certificate authority. Configuration that existed only at a provider, and logs that have rotated, are generally unrecoverable. The honest answer in a report is to record what is missing as explicitly as what is present.