Whose finding this is, and what the expert contributes
Reverse domain name hijacking is defined in paragraph 1 of the UDRP Rules as using the Policy in bad faith to attempt to deprive a registered domain-name holder of a domain name. Rule 15(e) makes the declaration mandatory once the finding is made: if after considering the submissions the panel finds that the complaint was brought in bad faith, for example in an attempt at reverse domain name hijacking or primarily to harass the domain-name holder, the panel shall declare in its decision that the complaint was brought in bad faith (UDRP Rules).
Note the grammar of that rule. The finding belongs to the panel. What an expert supplies is a records-based reconstruction — registration and acquisition dates, mark filing and registration dates, the actual state of a website at given moments, the correspondence and its headers — and nothing beyond it. The characterization of a complainant's conduct is not an expert question and never becomes one, regardless of how strongly the dates read.
This distinction is not modesty. An expert declaration that characterizes motive has stepped outside the records it is supposed to be establishing, and it invites the panel to discount the parts that were solid. Say what the record shows and when it was publicly available. Stop there. Everything downstream of that is argument, and argument requires counsel.
The two-column chronology
The core artifact is a dated chronology in two columns. Domain events on one side: creation, transfers, renewals, DNS and hosting changes, certificate issuances, archived captures. Mark events on the other: application, registration, claimed first use, status changes. Every row sourced to a retrievable record, with the retrieval date stated.
Built that way, the chronology answers questions that are otherwise argued in the abstract. What existed when. What was publicly checkable at the moment a complaint was prepared, and from which source. Whether the domain record and the mark record even overlap in time.
The sources are unglamorous and mostly public. Registry and registrar records supply creation, transfer and status events, supplemented in a live case by the registrar's Rule 4(b) disclosure. National and regional trademark offices publish filing, registration and status data. The Internet Archive, Certificate Transparency logs — public append-only logs of issued TLS certificates, each carrying an issuance timestamp — and passive DNS, a third-party archive of DNS answers observed over time, supply independent evidence of what existed and when.
Rows resting on party-held documents are marked as such, separately from rows anchored to independent records. A chronology that does not distinguish the two is asking the reader to take the weakest entry as seriously as the strongest.
Testing exhibits against independent records
A large part of this work is comparison rather than collection: taking the exhibits that were filed and asking whether they can be reproduced from a source under nobody's control.
An archived capture with a recorded timestamp either shows the page as described or it does not. A Certificate Transparency entry either places a host at a date or it does not. Passive DNS either records the resolution or has no observation for the period. HTTP header and redirect traces either reproduce the routing behavior described or show something else.
The output is an exhibit-by-exhibit comparison table with three honest columns: what matches, what does not, and what could not be tested. That third column is not padding. Where an exhibit cannot be reproduced from any independent record, the correct statement is exactly that — it could not be reproduced from the sources examined, which are named — and not an inference about how it came to exist. Similarly, where a filing appears to rest on partial material, what an expert can show is what the complete retrievable record contains: the rest of the page, the rest of the thread, the earlier capture. Whether that is material is the panel's judgment.
Correspondence, headers, and what they prove
Prior negotiations are a recurring feature of these records — an approach to buy the name, then a proceeding. The evidentiary question is narrow: what was sent, by whom, when.
That question is answered by the correspondence in its original form. Message headers — the routing and timestamp metadata an email carries, separate from its visible text — record transmission path and dates. Broker and marketplace records carry offer histories with their own timestamps. Pasted text in a document carries none of this and is worth very little, which is why correspondence gets preserved in original form with headers, alongside a rendered copy, with both hashed.
State the limit in the same paragraph as the finding: header analysis proves transmission, not authorship. It establishes that a message traveled a path at a time. It does not establish who sat at the keyboard, and an expert who lets that distinction blur has produced something that will not survive scrutiny.
Preservation timing matters here more than anywhere else on this page. Email and marketplace records are held by the parties and by platforms with finite retention schedules, and they need preserving before a case starts, not after — because once it does, the response window is twenty days, with an automatic four-day extension, and there is no discovery.
The published record, and refiling
Policy paragraph 4(j) requires that all decisions under the Policy be published in full, absent an exceptional panel decision to redact (ICANN UDRP). That single requirement is why one category of question here is answerable at all from public sources: whether an earlier proceeding concerning the same domain name exists.
Provider decision databases are public and searchable. The expert product is not a bare assertion that something was or was not found, but a search-and-retrieval record: what corpora were searched, on what date, with what queries, and what was returned. A panel or an opposing expert can then repeat the search and get the same result, or not. Reproducibility is the entire value of the exercise.
The same discipline applies to the comparison work described above, and for the same reason. Because RDNH material consists so heavily of comparisons rather than discoveries, what makes it checkable is the stated query, the stated source, the stated retrieval date and a hash of each retrieved artifact. An unreproducible comparison is an opinion wearing a table's clothing.
What this evidence cannot establish
Begin with the largest limit, because it governs everything else. An RDNH finding is made by a panel, on the papers, in the proceeding. No expert makes it, no report contains it, and no set of records compels it. WIPO states that the UDRP does not operate on a strict doctrine of binding precedent and that prior decisions are not strictly binding on panelists, who consider the particular facts and circumstances of each individual proceeding (WIPO Overview). Panels are not bound by one another, and materially similar records have produced different findings before different panels. That is a structural feature of the system, not a defect in anyone's evidence, and an annex written as though a particular finding follows from a particular record misstates how the mechanism works.
There is no discovery. Internal instructions, prior advice, and anything else bearing on what a complainant knew are unavailable in the proceeding. The record covers what was publicly checkable and when, not what anyone actually checked.
Archive and log gaps confine any statement about what a site did or did not show to what the retrievable captures actually contain.
Header analysis proves transmission, not authorship.
An unsuccessful complaint is not an abusive one. The two are distinct, and only the panel draws the line between them.
The finding is declaratory. Policy paragraph 4(i) limits remedies to cancellation or transfer; there is no monetary consequence under the Policy.
The window is the response, and there is no later stage
RDNH is decided inside the ordinary UDRP timetable. The response is due twenty days from commencement, with an automatic four-calendar-day extension available. A panel decides within fourteen days of appointment, and the decision reaches the parties within three business days.
Published WIPO material records that it is not necessary for a respondent to seek an RDNH finding for a panel to make one. The evidentiary consequence is unforgiving in either case: the records that bear on the question have to be in the response annexes, filed inside that window. There is no post-decision stage at which the material can be added, and further submissions are a matter of panel discretion under Rule 12.
So the practical sequence is the same as for any UDRP response, run under the same clock. Freeze the record on day one. Retrieve the trademark office data and the registry events immediately, since both are public and fast. Pull the correspondence in original form with headers. Run the decision-corpus searches and log them. Then write, knowing the word limit sits on the response body and the annex has to be readable on its own.
Where the expert stops
Worth restating as its own section, because this is the failure mode I see most often in reports on this subject.
An expert declaration in an RDNH context states what the records show, where each came from, when it was retrieved, and what could not be tested. It separates, visibly, the factual comparison from any inference, and keeps the inference minimal — ideally to nothing beyond what a reader would draw from the table unaided. It says explicitly that it opines on records and dates, and not on any party's state of mind or on the outcome of the proceeding.
It does not assess whether a complainant knew or ought to have known anything. It does not conclude that a complaint was abusive. It does not tell the panel that a set of facts satisfies a category from any overview, because that is the panel's job and because panels are not bound by such collections in any event. Doing the panel's job in an annex adds nothing the panel can verify and subtracts credibility from the parts it could have relied on.
I have testified in domain-related legal cases and have provided expert witness reports in other cases, and have worked in this field since 1996; the current engagement record is maintained at hartzer.com. Everything on the legal side of the line here — whether to raise the issue, how to frame it, what it means for a matter — requires counsel.