<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div dir="auto">[Resending to bind-users]</div><div dir="auto"><br></div><div dir="auto">Hi Rais,<div><br></div><div>this is a bit complicated matter as original RPZ specification has this bit:</div><div><br></div><div><div>This document may not be modified, and derivative works of it may not</div><div> be created, except to format it for publication as an RFC or to</div><div> translate it into languages other than English.</div></div><div><br></div><div>I don’t know what plans are and why did you submit this as I-D, but the mess around original RPZ specification needs to be solved first before we make any amendments to it.</div><div><br></div><div>The other option might be multivendor effort that avoids IETF altogether.</div><div><br></div><div>Ondrej<br><div><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 14. 10. 2025, at 12:33, Rais Ahmed <rais_ahmed@live.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Please review and engage relevant group/teams.<br>
<br>
Thanks</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg">
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>From:</b> Rais Ahmed <rais.ahmed@outlook.com><br>
<b>Sent:</b> Tuesday, October 14, 2025 3:28 PM<br>
<b>To:</b> rpz@lists.isc.org <rpz@lists.isc.org><br>
<b>Cc:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Proposal: RPZ-EDE Enhancement and URI-R Redirection Record (IETF Draft for Review)</div>
<div style="direction: ltr;"> </div>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dear ISC and BIND community members,</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I’d like to share a recently published Internet-Draft that proposes enhancements to DNS policy enforcement mechanisms, particularly around Response Policy Zones (RPZ) and Extended DNS Errors (EDE).</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Draft: DNS Policy Redirection Mechanisms: RPZ-EDE Enhancement and URI-R Redirection Record</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
https://datatracker.ietf.org/doc/draft-ahmed-dns-policy-redirect/</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Abstract:</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This document defines two complementary mechanisms to improve user experience and policy transparency in DNS-based filtering. The first extends RPZ operation through the use of EDE signaling to provide explicit policy reasons and better client handling. The
second introduces a new URI-REDIRECT (URI-R) Resource Record to enable secure redirection for HTTPS traffic, avoiding TLS certificate errors that occur when traditional IP substitution is used.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Both mechanisms are designed to be independent yet interoperable, providing flexible paths for resolver vendors and operators to enhance policy signaling and user redirection in a DNS-compliant way.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Given ISC’s role in the development and maintenance of BIND and RPZ, your feedback on operational feasibility, implementation considerations, or alignment with current BIND behavior would be invaluable.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Rais Ahmed</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Transworld / DNS Infrastructure Projects</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Email: rais.ahmed@outlook.com</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
IETF Draft: <a data-auth="NotApplicable" class="OWAAutoLink" id="OWAa70b6cc4-7f6a-90c8-9542-acfb8b90a900" href="https://datatracker.ietf.org/doc/draft-ahmed-dns-policy-redirect/">
https://datatracker.ietf.org/doc/draft-ahmed-dns-policy-redirect/</a></div>
</div></blockquote></div></div></div></body></html>