[DNSOP] Re: New Version Notification for draft-muks-dns-filtering-04.txt
Mukund Sivaraman <muks@mukund.org> Thu, 23 April 2026 14:39 UTC
Return-Path: <muks@mukund.org>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9BB42E1BE2F8 for <dnsop@mail2.ietf.org>; Thu, 23 Apr 2026 07:39:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1776955184; bh=jvGF5FycCJSnxwWi1ovvbYRKwtLrK0hccNlk0ky9xpY=; h=Date:From:To:Subject:References:In-Reply-To; b=H42/EiKqqHp+F1O8j09HPIcZT4PQ8Id+GzmtoU1J/YvBtsc7R9aDItnOk8sxYnyGl O9yi3QPTWv+de4q8DelRG2DxZlc+8RuX9y4mGlWBjNZcmSjiqm8FzQn3Z1AzQKDBqY pt7ZPquE66OtljZwURe+sXNMFCDw75cfoiIgLrq0=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=mukund.org
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6UTJoB8UVkGN for <dnsop@mail2.ietf.org>; Thu, 23 Apr 2026 07:39:41 -0700 (PDT)
Received: from mx.mukund.org (mx.mukund.org [188.40.188.216]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C7F58E1BDB1D for <dnsop@ietf.org>; Thu, 23 Apr 2026 07:39:06 -0700 (PDT)
Date: Thu, 23 Apr 2026 22:39:03 +0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mukund.org; s=mail; t=1776955145; bh=jvGF5FycCJSnxwWi1ovvbYRKwtLrK0hccNlk0ky9xpY=; h=Date:From:To:Subject:References:In-Reply-To:From; b=I0cC3vC4qxisKlNYrqkA2+r4VpM2KN19A2uFENwDE76fvbXVqDNvB3eA8DYRpkwcZ 6Kk4sWH78YX2HiDcxyRWtLv0vkchqRKMAiUKZUb2QWzrIN6Qdv4ugIjx6RoXDmpWiP zbqoXfkk5dT9r6BYGsXFC7Ddm30dPn2AMPNUTXVMmnz42f/PMsIjrNDFDPf8ieN3ff kJbsDtGdU4ZcTHTUQXoaOSEJyd/aMPxVLHlI9LWCALNIpQxGU78ZZTVE6a4zDrKWNR oj7PZgrp3VDz3jm4/IQGLGFbvF3oWmj6hC2NCX8iob9OFEefUvN7XfUs+6b/6DXfGB D/fJmJzldwsbg==
From: Mukund Sivaraman <muks@mukund.org>
To: dnsop@ietf.org
Message-ID: <aeovB8tMUgRWXVGo@p5>
References: <177693519864.1213617.2665659515452139871@dt-datatracker-b45949c58-5szpr>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="8KIN8Mky3GtZ3+Fl"
Content-Disposition: inline
In-Reply-To: <177693519864.1213617.2665659515452139871@dt-datatracker-b45949c58-5szpr>
Message-ID-Hash: ZRBPNBLVCZCNL7SWLRJOCXIA2PUBC2GX
X-Message-ID-Hash: ZRBPNBLVCZCNL7SWLRJOCXIA2PUBC2GX
X-MailFrom: muks@mukund.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: New Version Notification for draft-muks-dns-filtering-04.txt
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/dObnC_jpbB88oZNSUwipmmVYiQk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>
On Thu, Apr 23, 2026 at 02:06:38AM -0700, internet-drafts@ietf.org wrote: > A new version of Internet-Draft draft-muks-dns-filtering-04.txt has been > successfully submitted by Mukund Sivaraman and posted to the > IETF repository. Section 9 shows a DNS response message dissected by Wireshark, with the EDNS filtering options: https://datatracker.ietf.org/doc/html/draft-muks-dns-filtering-04#name-example-dns-message There is also a sample configuration of how RPZ is configured in Loop, esp. for the FILTERING-DB option. (Note that this is a filtering database, i.e., the source of filters, not a filtering incident database.) The OPT RR is the DNS version of an extensible "container" to pass various options/variables. A similar example from another protocol would be DHCP's options. The example illustrates how a DNS savvy person views the options in a DNS message. The following screenshot of Wireshark shows how these options lend themselves naturally to filtering packets on specific values: https://imgur.com/a/imr2K4n A Wireshark patch is available here, which implements support for these EDNS options for filtering and uses option codes from the experimental use range: https://raw.githubusercontent.com/muks/draft-muks-dns-filtering/refs/heads/main/patches/wireshark-dns-filtering.patch Mukund
- [DNSOP] New Version Notification for draft-muks-d… internet-drafts
- [DNSOP] Re: New Version Notification for draft-mu… Mukund Sivaraman