Domain name evidence, forensics and litigation support
Abstract offset block illustration representing In Rem Domain Name Jurisdiction

EvidenceProcedural

In Rem Domain Name Jurisdiction

Produces
Registrar identification, notice and diligence record
Sources
RDAP, IANA root zone database, registrar records, mail logs
How it is obtained
Public retrieval plus registrar records under legal process
Authority
15 U.S.C. 1125(d)(2); 15 U.S.C. 1127; FRE 901, 902

An action against the domain name itself turns on records — who the registrar is, what data is on file, and what notice was sent

A case against the name itself, and only in the United States

US-specific. The in rem provision at 15 U.S.C. 1125(d)(2) is United States federal law. In rem means a case brought against a thing — here the domain name — rather than against a person. Nothing outside US federal practice works this way, and whether a given registrar, registry or country-code extension falls within the provision is a legal question for counsel that this page does not answer.

What makes the provision unusual, and the reason a domain name expert is involved at all, is that its conditions are to an unusual degree records questions. Who the registrar is. Where the registry operator sits. What contact data the registrant actually gave the registrar, as distinct from what is published. What notice was sent, to which address, and what came back. Those are answerable from records, and they are answered the same way whether or not the action is ultimately brought.

The remedy is limited by the text to forfeiture, cancellation or transfer of the name. There is no monetary relief under this paragraph. That is a feature of the statute, stated here as such, and it carries no suggestion about which route any party should take.

What the statute treats as a domain name

The definition sits at 15 U.S.C. 1127: an alphanumeric designation registered with or assigned by a domain name registrar, registry or other registration authority as part of an electronic address on the internet. Four consequences follow, all of them factual.

  • The definition is registration-based. What makes a string a domain name here is that a registrar, registry or authority registered or assigned it — so the threshold question is answerable from registration data.
  • It reaches the alphanumeric designation as registered. For an internationalized name that means the A-label, the xn-- ASCII form actually held in the registry, as well as the Unicode form a user sees. Both belong in the record, because they are different strings.
  • "Other domain name registration authority" is broader than registrar and registry. That is the phrase which, on the statute's face, carries country-code managers and other authorities into scope.
  • The definition says nothing about property. Whether a domain name is property is precisely the legal question this page leaves alone.

The statutory conditions, read as a records checklist

The action may be filed in the judicial district where the registrar, registry or other authority that registered or assigned the name is located, if two things hold. First, the domain name violates a right of the owner of a mark registered at the Patent and Trademark Office, or protected under the false designation or dilution subsections. Second, either the court finds the owner cannot obtain personal jurisdiction over a person who would have been a defendant, or the owner, through due diligence, was not able to find such a person — having sent notice of the alleged violation and intent to proceed to the registrant at the postal and email address the registrant provided to the registrar, and having published notice of the action as the court directs promptly after filing.

Those diligence steps are themselves treated by the statute as service of process. The consequence for an expert is that the notice artifacts are not administrative paperwork. They are evidence of a jurisdictional condition, and they need to be preserved as such: the message as sent with full headers, the transaction result, delivery or non-delivery reports and bounce codes, postal proof of dispatch and return, and a dated capture of any published notice.

Identifying the registrar, the registry, and where they are

The first deliverable is an identification memorandum, and it is more careful work than it sounds. From the registration record: the sponsoring registrar's name and its IANA registrar identifier, the permanent number assigned to an accredited registrar. Names change and trading names differ from corporate names; the number persists, which is why it goes in the report alongside the name.

The registry operator for the extension is then read from the IANA root zone database, which is the authoritative public record of who runs each top-level domain. Corporate location is a separate question again, and it is answered from corporate records rather than from a registration field. A registration record gives a registrar name and identifier; it does not give a legal domicile, and an expert who treats the two as the same thing has handed the other side an easy point.

One further trap. The sponsoring registrar of record may not be the entity the registrant actually dealt with. Reseller relationships are invisible in public registration data and surface only in registrar-produced records.

The address in the statute is not the address you can see

This is the practical heart of the page, and it is where most in rem notice work goes wrong.

The statute refers to the postal and email address provided by the registrant to the registrar. Published registration output is a different thing. Under current gTLD registration data policy, registrant name, street, postal code, phone and email are redacted where applicable law requires, and an alternative contact mechanism is published in place of the email address. A privacy or proxy service interposes a forwarding address of its own.

So the address named in the statute and the address visible in a public lookup are frequently not the same address. That difference is a fact for the expert to document rather than gloss: what the public record shows, what the registrar's records show, when each was captured, and how they differ. Establishing the data on file requires the registrar, and reaching the registrar generally requires legal process.

A related caution: with a forwarding address in the path, whether a message reached the underlying registrant is often unknowable from the sender's side. A message that does not bounce is not a message that was received.

Documenting diligence, including everything that found nothing

The due-diligence limb produces its own artifact: a log of the searches run, when, with what tool and version, against what source, and what each returned — including the null results. A diligence record whose negative results are not documented is not a diligence record. It is a list of the things that worked.

In practice the searches span historical registration data, reverse-registrant searches across historical datasets, hosting and address records, certificate transparency entries, archived contact pages from the site itself, and marketplace listings. Each one either produced an identifying lead or it did not, and both outcomes are recorded in the same table with the same fields.

The notice artifacts are preserved the way any outbound record is preserved. Raw message files with full headers, not forwarded copies — a forward loses the original routing chain and the sender-authentication results, which is exactly the material that shows a message went where it purports to have gone. Hash at creation. Keep the transaction transcript or the bounce report. Capture any published notice as a dated page capture rather than a screenshot.

Status codes, deposits, and the clocks that run anyway

Registration status is captured before and after notice. EPP status codes — the machine-readable flags on a registration showing whether it can be transferred, updated or deleted — record what constraints were in force at each point, which matters because the statute restricts modification of the name during the pendency of the action other than on court order.

On written notification of a filed complaint, the registrar, registry or other authority is to deposit with the court documents sufficient to establish the court's control and authority over the disposition of the registration. The instrument is often referred to informally as a registrar certificate; that phrase is a description rather than a defined term in any policy document, and a report should treat it that way. The statute sets no number of days for the deposit, and none should be supplied.

Meanwhile the registration lifecycle runs regardless of the litigation. Expiry, redemption and pending-delete periods do not pause for a filed case, and a name allowed to lapse mid-matter creates a problem no amount of evidence work repairs. Expiry dates get diarized on day one.

What the in rem record cannot establish

The records answer where things sit and what was sent. They do not answer whether the statutory conditions are met, and they do not answer where an action may be brought. Both are for the court.

  • Redaction bites hardest exactly here. The address the statute names is the one the registrant gave the registrar, and that is the field most reliably absent from public output.
  • A non-bounce is not receipt. With a privacy or proxy forwarding address in the path, delivery to the underlying registrant is usually unknowable from the sending side.
  • A registration record is not a corporate record. It gives a registrar name and identifier, not a legal domicile, and a reseller may sit between the registrant and the sponsoring registrar without appearing anywhere in public data.
  • Historical registration archives are third-party observations — sampled, gapped, and without chain of custody to the registrar.
  • Country-code extensions sit outside gTLD policy and vary in what registration data they publish, if any.
  • Diligence proves searching, not absence. A documented search that found nobody records what was looked for and what came back. It does not establish that no findable person exists.

What a retaining attorney should expect

The deliverable set is small and specific: a registrar and registry identification memorandum with the raw registration response, the IANA identifier, the registry operator and the basis for any location statement; a registrant-data statement distinguishing published data from data on file; a notice and diligence log with headers, bounce codes and dated captures; a status-code snapshot before and after; and the hashed, timestamped collection record underneath all of it.

US-specific: authentication runs through FRE 901, with the self-authentication routes at 902(13) and 902(14) available for records generated by an electronic process and for verified copies. Notice evidence has one distinguishing feature — much of it is the party's own outbound record, so preserving raw messages rather than forwards, and hashing at creation, matters more here than almost anywhere else.

Bill Hartzer has testified in domain-related legal cases and has provided expert witness reports in others, and has worked in this field since 1996; the current engagement record is kept at hartzer.com. Whether to proceed in rem, and where, are decisions for counsel.

Frequently Asked Questions

What is an in rem domain action?

Under United States federal law, a mark owner may in defined circumstances file a civil action against the domain name itself rather than against a person, in the judicial district where the registrar, registry or other registration authority that registered or assigned the name is located. The remedy the statute allows is limited to forfeiture, cancellation or transfer of the name; there is no monetary relief under that paragraph. Whether the conditions are satisfied in any given matter is a legal question for counsel and for the court, not for a technical expert.

What does a domain expert contribute to an in rem action?

Records work, and a surprising amount of it. Identifying the sponsoring registrar and its permanent IANA identifier, the registry operator for the extension from the IANA root zone database, and the basis for any statement about corporate location. Establishing what registrant contact data is actually on file with the registrar, as distinct from what is published. Preserving the notice artifacts as raw messages with full headers, transaction results and bounce codes. And logging the diligence searches, with their null results recorded as carefully as their hits.

Why does redaction matter so much in an in rem matter?

Because the statute refers to notice sent to the postal and email address the registrant provided to the registrar, and that is precisely the data most reliably withheld from published registration output. Under current gTLD registration data policy, registrant name, street, postal code, phone and email are redacted where applicable law requires, with an alternative contact mechanism published instead. The address named in the statute and the address visible in a lookup are therefore frequently different addresses, and the difference is something to document with dates and captures rather than paper over.

Can notice be evidenced with a screenshot of a sent folder?

It can be produced that way, but it is weak, and it is avoidable. The stronger record is the raw message file with full headers, preserved and hashed at creation, together with the transaction transcript or the delivery and non-delivery reports. A forwarded copy loses the original routing chain and the sender-authentication results, which is the material that shows where a message actually originated and where it went. Published notice is captured as a dated page capture with the retrieval method recorded, not as an image pasted into a document.

Does an in rem action mean the registrant no longer needs to be identified?

Attribution work usually continues regardless. The statutory route is framed around the inability to reach or find the person, and establishing that inability is itself a documented search rather than an assumption. Beyond that, an identification can surface at any point and change the posture of the matter. A domain expert's registrant attribution work — historical registration data, infrastructure linkage, certificate and hosting records — runs alongside, and its negative results are part of the diligence record rather than a dead end.

What happens to the registration while the action is pending?

The statute directs that on written notification of a filed complaint the registrar, registry or other authority deposit with the court documents sufficient to establish the court's control over the disposition of the registration, and not transfer, suspend or otherwise modify the name during the pendency of the action except on court order. As a practical matter the registration lifecycle does not pause: expiry, redemption and pending-delete periods run on their own schedule, so expiry dates should be diarized at the outset of any domain matter.
Keep reading

The guides put the pieces in order

An entry covers one kind of work and the record it produces. A guide runs the sequence: when an expert is retained, what is preserved first, what has to be authenticated, and what the report has to carry.

A reference, not an intake page. This site describes what a domain name expert witness does and what the domain record can be made to show. It is not legal advice, nothing on it creates any relationship, and no engagement is taken through this website. The current record of credentials is at hartzer.com.

Top