# Where onchain names fit in a brand protection budget
> Defensive domains, monitoring, enforcement: budgets are already allocated. How to place onchain names among them without guessing.
Source: https://hush.partners/onchain-names-in-the-brand-protection-budget
Category: Brand protection
Published by Hush Partners.
---
Brand protection budgets are built on known cost shapes. A defensive DNS portfolio costs a predictable amount per name per year. Monitoring tools invoice monthly or annually. Enforcement is lumpy and event-driven. Finance understands all three because they repeat, and each item is usually small enough to live in an operating budget without a capital approval.
Onchain names do not fit that shape. Acquiring a top-level domain onchain is a one-time transaction with no registry renewal. Monitoring remains a recurring cost, but the enforcement path is different from anything a UDRP practice has prepared you for. The cost structure is different in kind, and unfamiliarity is only part of the difficulty.
This article works through the economics of both worlds side by side. By the end, you will be able to place onchain names in the right budget category, identify the recurring costs that belong there, and present the line to a finance director with reasons rather than analogies. You will also be able to argue against the line where the reasons do not hold, and you will know what you can do before any budget is approved.
## The cost structure of a defensive DNS portfolio
A defensive DNS portfolio is a set of domain names registered under conventional top-level domains, held not because the organization uses them but to stop others from doing so. The cost structure has three layers.
The first layer is acquisition. A registration fee is typically modest for each name and is treated as an operating expense in the year it arises. The second layer is renewal. Every name must be renewed with its registrar, usually every year, or it lapses and becomes available to anyone. That renewal obligation has no end: a portfolio of several hundred names generates a similar invoice every year, and the amount moves only when names are added or dropped or when a fee changes. The third layer is management: someone must track expiry dates, review the portfolio for names that are no longer needed, and add names when a new product line or market creates new exposure. That staff cost is real even when it is not itemized separately.
The cost of a defensive DNS portfolio is therefore simple arithmetic. More names, more cost, every year. The portfolio grows when monitoring flags new lookalike registrations, and it does not easily shrink, because dropping a name means accepting that someone else may register it. Finance sees a flat or slowly rising annual line with no end date.
A typical portfolio covers the primary brand under the TLDs that matter in the organization's markets, common misspellings, and close variants. [Brand protection teams](/brands-and-legal-teams) that manage several brand families can end up with hundreds of names. Each is a small recurring cost; in aggregate they are not trivial, and the aggregate is the figure to bring into any comparison with onchain names.
## How acquiring an onchain TLD differs structurally
An onchain TLD on the Freename registry is a token held in a wallet. Owning the TLD means holding that token. The registry charges no annual renewal fee for it. The acquisition is a single transaction. Once the transfer has settled, the registry asks for nothing more to keep the TLD.
That changes the cost curve. A defensive DNS registration creates an obligation the moment you make it, because you must renew it or lose it. An onchain TLD acquisition is a one-time outlay with no mandatory follow-on registry cost. The budget question shifts from "what does it cost per year" to "what did it cost once."
The second structural difference is scope. Under a conventional TLD, a registrant holds one name, such as `yourbrand` under a single extension, and anyone can register the same label under a different extension. Under an onchain TLD, the scope is the whole namespace. On Freename, the right to issue names under a TLD belongs to its holder and to nobody else. Whoever holds `.yourbrand` decides whether `pay.yourbrand` or any other name under it comes into existence. One caution belongs here: names issued before a transfer were issued by the previous holder, so what already exists under a TLD is part of what you check before acquiring it.
That scope means the defensive logic is different. A DNS defensive portfolio is wide: many names across many TLDs. An onchain TLD acquisition is deep: one asset that covers an entire namespace. The [comparison between a dotBrand and an onchain TLD](/dotbrand-vs-onchain-tld) raises further considerations, but the structural point holds: depth and width are two different ways of spending on defense.
The practical consequence for a budget holder is that the onchain acquisition should not be measured against the cost of a single domain registration. It is measured against the aggregate recurring cost of a defensive program, over a time horizon you choose and state.
## Comparing the cost structures directly
The table below maps the cost categories of a conventional DNS defensive program against their equivalents in an onchain TLD acquisition. It carries no prices. It shows where recurring costs arise and where they do not.
| Cost category | DNS defensive portfolio | Onchain TLD acquisition |
|---|---|---|
| Initial acquisition | Registration fee per name, operating expense | One-time purchase of a token; classification to be decided |
| Registry renewal | Recurring, per name, with no end | None on a Freename TLD |
| Monitoring | Recurring, tool or in-house | Recurring, onchain records to watch |
| Enforcement | UDRP or court action, case by case | No equivalent of the UDRP; varies by country |
Management overhead exists on both sides and takes a different form: expiry tracking and portfolio review for the DNS, wallet custody and a policy on who may issue names for the onchain TLD.
The most significant line is renewal. The longer a DNS portfolio is held, the larger the share of its total cost that renewals represent, and that share keeps growing for as long as the names are kept. An onchain TLD held for the same period has paid its acquisition cost once. This is the single difference a finance director needs to see first, because every other argument follows from it.
## Monitoring: the recurring cost that does not go away
Monitoring is where the two worlds converge on cost structure. In both, someone must watch for new registrations or uses that affect the brand, and that watching is a recurring cost.
In the DNS world, brand monitoring services scan new registrations across TLDs, flag lookalike names, and track impersonation that relies on domain names. Those services are usually sold by subscription. The cost tends to scale with the number of brand terms and TLDs being watched.
Onchain monitoring differs in its mechanics. The relevant records live on public blockchains, and anyone can read them with a block explorer, a website that displays what a blockchain has recorded. The operational question is not whether the data is accessible. It is whether someone is watching it on a schedule, interpreting what they find, and escalating what matters. A [namespace watch service](/namespace-watch) is one way to organize that observation, and it is a recurring cost like any other monitoring.
The important point for a budget holder is that you carry this cost whether you have acquired the TLD or not. If you have not acquired `.yourbrand`, you still need to know whether it has been created and whether names are being issued under it. If you have acquired it, you need to know whether a lookalike TLD has appeared. The acquisition does not remove the cost; it changes its character. Before acquisition, you are watching for something to act on. After acquisition, you are watching for residual exposure and for activity on the TLD you now control.
Neither form of monitoring belongs in the capital budget. Both are operating expenses, invoiced periodically, and both belong in the brand protection operating budget regardless of what happens on the acquisition side. That also makes monitoring the easiest onchain item to approve: it has the same shape as a line finance already signs every year.
## Enforcement costs and why they are harder to budget onchain
UDRP enforcement in the DNS world is not cheap, but it is predictable. The process is established, the procedural costs are published in advance by the dispute resolution providers, a decision usually arrives faster than a court judgment would, and the possible outcomes are few and known. A brand protection budget can carry a reserve for a small number of UDRP filings per year, sized from the organization's own history. Finance accepts this because the range is narrow.
Onchain enforcement has no equivalent. The UDRP applies through the contracts that tie registrants to ICANN-accredited registrars. It has no hold over a registry that runs on smart contracts outside the ICANN system. Neither an onchain TLD nor a name issued under it can be transferred to a brand owner through a UDRP filing. The tools that remain are the general ones: a claim before a court, an order against an identifiable party, or a negotiated acquisition. What each can achieve depends on the country and on whether the other party can be identified at all, and your own counsel decides which applies. None of them has the cost predictability of a UDRP.
This matters for budget presentation. An enforcement reserve for DNS matters can be a defined line with a defensible methodology. An enforcement reserve for onchain matters is harder to size because the procedural path has not been standardized. There is also an asymmetry worth stating to finance: if the brand owner holds the onchain TLD, there is no dispute to have over that namespace, because nobody else can issue names under `.yourbrand`. The acquisition settles the question for that namespace. What remains is the exposure to lookalike TLDs, which is a different and smaller question.
[Recovering an onchain TLD](/brand-namespace-recovery) that matches your brand and is held by someone else is an acquisition, not an enforcement action. It is a negotiated transaction, not a filing with a published fee schedule. Its cost cannot be estimated without knowing the holder's position, and a figure put forward before any contact with the holder is a guess. If the budget carries anything for that eventuality, it is a reserve, sized conservatively, kept apart from the operating lines and labeled as an estimate.
## Ranking names by exposure before spending anything
Spending on defensive registrations, onchain or otherwise, without first ranking the brand's exposure is how portfolios become large and disorganized. The right sequence is to identify which namespaces carry material risk, rank them, and only then decide where money goes.
For the conventional DNS, the exposure question is relatively well understood. A brand that sells online needs its primary name protected under the country-code TLDs of its markets. A brand with consumer-facing payment products pays closer attention to names that suggest payment or login. The methodology is imperfect but the inputs are clear.
For onchain namespaces, the [Namespace Exposure Score](/namespace-exposure-score) is a structured starting point. It scores how exposed a brand is onchain, and it can be run before any budget commitment is made.
Sequence before any onchain budget is committed
Score every brand in scopeBefore any number goes into a budget request, run the Namespace Exposure Score for each brand. The tool is free.
Check the registry recordFor each brand that scores high, look up the matching TLD on a block explorer. The registry record is public, so you can see whether the TLD exists and whether it is held.
Separate the pathsA TLD that is held by someone else is a recovery question. A TLD that has not been created is a registration question. Each path has a different cost shape and a different approval route.
Rank and triageBrands in a portfolio do not share the same onchain exposure. Rank them by how much is at stake and address the highest first.
Budget by cost shapeOne-time acquisitions go to whoever approves one-time spending. Recurring monitoring goes to the operating budget. Any enforcement or recovery reserve is sized separately.
This sequence applies regardless of the organization's size. A brand with a single primary name and no known onchain activity still benefits from scoring itself before deciding that no budget is needed. "We checked and found no material exposure" is a defensible position. "We did not check" is not.
The ranking also protects you in the other direction. A request that covers every brand in the house at once invites a refusal. A request that names the two or three brands with the highest exposure, and explicitly sets the others aside with the reason, shows finance that the line has been cut down before it reached them.
## Capital against operating expense: where each cost belongs
The distinction between capital expenditure and operating expenditure matters to the finance director who receives the request, and to whoever must book the cost correctly. How an onchain TLD acquisition is classified is not settled. It depends on the accounting framework the organization reports under, on the country, and on the facts of the acquisition. Your own counsel, accountants and auditors make the call. What follows is information, not advice.
A conventional domain registration is commonly treated as an operating expense: you pay for a period of use, and the cost is expensed over that period. Some organizations capitalize domain names that have a separately identifiable value, but for defensive registrations with no active use, expensing is the usual treatment.
An onchain TLD acquisition has a different profile. The token carries control of a namespace for as long as it is held, with no mandatory renewal cost. That profile is closer to an acquired intangible asset than to an annual subscription. Arguments exist for recording it as an intangible asset and reviewing its value periodically. Arguments also exist for expensing it in the period of acquisition, particularly where the TLD has no active use and its value is uncertain. Token-based assets raise classification questions of their own, which is one more reason to bring the accountants in before the request is written, not after.
The practical consequence is that an onchain TLD acquisition may need to go through capital approval instead of the operating budget. That is a longer internal process in most organizations. It is not a reason to drop the acquisition. It is a reason to build the right case for the right audience, and a capital request usually needs a documented basis for the amount. Knowing [how a TLD valuation is built](/valuation) helps you test whether an asking price can be defended in that file.
### Who pays
A defensive DNS portfolio usually has an obvious owner: the legal or brand protection budget, sometimes shared with IT, which runs the registrar account. An onchain TLD has no such default home, and the request can stall for that reason alone.
Three candidates tend to appear. Legal pays when the purpose is purely defensive and the TLD will sit unused. Marketing or product pays when the TLD will be put to work, for example for names issued to the organization's own services. Treasury or IT is drawn in because a token in a wallet needs custody rules, whoever funds it. Settle the question before the request goes out. A workable split is that the function that benefits funds the acquisition, legal funds the monitoring, and the custody policy is written by whoever already manages the organization's keys or signing authorities.
Monitoring costs are operating expenses in both worlds. An enforcement reserve sized for filings and legal fees is an operating provision. A reserve sized for the possible acquisition of a held TLD follows the classification of the acquisition itself.
## What a zero budget still allows
Not every organization will approve a new budget line on first request, and the finance cycle may be months away. In the meantime, several steps cost nothing and create no commitment.
The Namespace Exposure Score is free. Running it before the budget discussion means the request rests on a documented result instead of an impression. The [Trademark Name Check](/trademark-tlds#check) is also free, and the page that holds it explains what a trademark TLD is, which is useful background for a reader in finance who has never met the term.
Checking the public registry record for a TLD requires only a block explorer. Any organization can see whether a given onchain TLD exists and whether it is held, without a relationship with any service provider. Note the result and the day you checked in your own file: a record of what you looked at is part of a defensible position.
Reading costs only time. The audience page for general counsel and brand protection teams on this site sets out how such teams approach onchain exposure, and the capabilities page listed further down shows what onchain names can do in practice.
A zero budget also allows a decision not to act. If the score is low, the matching TLD does not exist and none of the organization's customers use wallets that resolve onchain names, declining the line is a reasoned position. Write it down with its reasons and the conditions under which you would reopen it. That is a better outcome than a line approved without a ranking behind it.
None of these steps creates an obligation or generates an invoice. Together they produce a documented picture of the organization's onchain exposure that is ready when the budget is.
## Presenting the line to finance
A finance director reviewing a new line for onchain names will ask four questions, in roughly this order. Each has a short answer if you have done the preparation.
**What is the cost, and what recurs?** The acquisition is a one-time item, capital or operating depending on the accounting treatment. The recurring cost is monitoring, an operating subscription comparable to the brand monitoring already in the budget. The registry charges no renewal.
**What is the risk if we do not spend?** The risk is that the TLD matching the brand is held by someone else, who alone can issue names under it, and that the UDRP offers no route to it. The remaining path is a negotiated acquisition, whose cost depends on the holder and cannot be fixed by the buyer alone. State this as a possibility to be ranked, not as a certainty. The exposure score tells you which brands carry that risk at a level worth bringing to finance.
**How does this compare with what we already spend on DNS defense?** The comparison is not one name against one name. It is the aggregate DNS defensive spend over a stated horizon, renewals included, set beside the one-time acquisition cost of a TLD that covers a whole namespace.
**What happens if the technology is not widely adopted?** This question deserves a direct answer. Because onchain names sit outside the ICANN DNS root, a standard browser needs added support before it will open one, and that support is partial and changes over time. A TLD that is little used has less practical value to anyone, the brand owner included. The defensive case does not rest on wide adoption. It rests on the wallets and browsers where these names do resolve, where a name that resembles the brand can mislead a user or receive a payment meant for the organization. The [capabilities that are live](/whats-live) are documented with sources. Argue the line on that narrower basis and leave future adoption out of it.
### A worked example in units, not prices
A worked example shows the arithmetic without a single price. The assumptions are these: one brand; a defensive DNS portfolio of 80 names; every name costs the same amount per year held, the first year included, and that amount is called one unit; the monitoring subscription is identical in both cases and is left out.
Over five years, the portfolio costs 80 names times 5 years, or 400 units. Over ten years, it costs 800 units. Now assume, purely for illustration, that the onchain TLD matching the brand is acquired for the equivalent of 200 units. That outlay equals two and a half years of the portfolio's cost. Over the ten-year horizon it is one quarter of what the DNS portfolio costs in the same period, and it does not grow in year eleven while the portfolio adds another 80 units.
Two cautions keep the example honest. First, the onchain TLD does not replace the DNS portfolio, so the 200 units are added to the 800, not subtracted from them. The comparison shows proportion, not savings. Second, the 200 units are an assumption. With an acquisition cost of 800 units, the same reasoning shows a line as large as ten years of DNS defense, and declining it may be the right call.
Running that comparison with the organization's own figures is the budget presentation. Replace the unit with your average annual cost per name, replace 80 with your real count, and put the real acquisition figure beside the result once you have one.
### Where Hush Partners comes in
When the matching TLD is held and you decide to pursue it, the approach can be mandated to a desk. Hush Partners is a private desk for onchain TLDs that acts for organizations wishing to have a holder found and approached. The mandating organization pays a fixed fee, never a share of the price, and closing runs through onchain escrow on an aftermarket. Nothing in the steps above requires that mandate: the ranking, the registry check and the classification question are yours to settle first.
## Questions people ask
### Does holding an onchain TLD replace the DNS defensive portfolio?
No. The two systems are independent. An onchain TLD on Freename does not resolve in the conventional DNS, and a conventional registration has no effect on the onchain registry. Holding `.yourbrand` onchain does not protect the same label under any conventional extension, and the reverse is equally true. The onchain acquisition is an addition to a brand protection program, not a substitution, and the budget request should say so in plain words to avoid a later question about savings that were never promised.
### Who manages the onchain TLD after acquisition?
The token sits in a wallet, and whoever controls the wallet controls the issuing of names under the TLD. Day-to-day management is lighter than for a DNS portfolio because there are no expiry dates to track, but custody is a real operational requirement. Key management, continuity if the people in charge leave, and access rules for those allowed to issue names all need a written policy. A multisignature wallet, which requires several approvals before anything moves, is a common way to avoid dependence on one person. The page on [post-transfer activation](/post-transfer-activation) covers putting a TLD to work after the transfer.
### Can a TLD be resold if the brand protection case no longer applies?
The token is transferable, so a sale is technically possible if a brand is retired or the organization decides the TLD is no longer needed. Whether a buyer exists, and at what price, is a separate matter that nobody can promise in advance. A free tool on the site, the TLD Readiness Score, scores how ready a TLD is to be sold. For a capital approval, the fair statement is that the asset can be transferred, not that its cost can be recovered.
### Does the UDRP cover onchain names?
The UDRP applies to names registered under TLDs in the ICANN system. It does not reach onchain registries that operate outside that system. Whether another legal route exists in a given dispute depends on the country and the facts, and your own counsel decides. For budgeting, the safe assumption is that no standardized procedure with published costs is available for onchain names.
### Where does the Freename royalty program fit in the budget?
Freename runs a royalty program for TLD holders. When names are registered under a TLD, part of each registration fee goes to the holder of that TLD. For a budget file, the only figure to quote is the advertised one, a share of up to half, and it depends on the registry's current terms and activation conditions. That inflow is not guaranteed: it exists only if the TLD is opened to registrations and names under it are in fact registered. A defensive TLD that issues no names to others earns nothing. The program also has a cost side: although the TLD itself has no annual renewal fee, taking part in the royalty program carries an annual cost set by the registry, and a budget that counts the inflow must carry that line too. The budget owner should note one exception: where a TLD was registered under earlier terms that include the program for life, as some were, the registry must confirm before closing whether those terms pass to a buyer. In a budget presentation, the conservative assumption is zero inflow. If opening the TLD is part of the plan, the Subname Revenue Calculator on the site estimates revenue from names issued under a TLD; treat its output as a sensitivity test and never as a forecast.