UTXO Domain Name System (UTXO6-DNS): Base Protocol and PRN Regulatory Extensions

Document Status: Experimental This document is published as an Experimental specification. According to , the "Experimental" designation typically denotes a specification that is part of some research or development effort. Such a specification is published for the general information of the Internet technical community and as an archival record of the work. This document is not on the IETF standards track. It does not represent IETF consensus, nor does it imply any endorsement by the IETF, the IESG, or any IETF Working Group. It is an individual submission published for experimental and informational purposes only. The base protocol described in Section 2 is intended to form the basis for future standardization; the PRN extensions in Section 3 and the compliance enforcement model in Section 4 are experimental. Readers are advised that the mechanisms described in this document have not been subject to broad interoperability testing, security review, or IETF Working Group scrutiny. Deployment should be undertaken with caution and after appropriate risk assessment.

Introduction

Background and Problem Statement Traditional DNS maps names to IP addresses. However, modern digital assets (cryptocurrencies, tokenised real-world assets, NFTs) are identified by opaque blockchain addresses that are not routable, not human-friendly, and lack a standardised binding to the Internet's naming and addressing layers. This forces each blockchain application to build its own messaging overlay. Meanwhile, IPv6 provides a 128-bit address space with a 64-bit Interface Identifier (IID) that is programmable by design -- but current IID generation (RFC 7217) uses only local device information, not asset ownership. This document defines the UTXO6-DNS protocol, which bridges that gap by allowing a domain name to resolve to a UTXO endpoint identifier, and by providing a method to generate IIDs directly from UTXO ownership using Verifiable Random Functions (VRF, RFC 9381). The system allows a human-readable '.utxo' domain name to resolve to a routable IPv6 address that is cryptographically owned by the UTXO holder. Furthermore, for adoption by regulated financial institutions, the protocol is extended with the Penetrating Regulation Node (PRN) overlay to meet AML/CFT regulations, provide auditable transaction records, and verify legal entity identities. These extensions are optional and do not affect the core resolution protocol.

Scope This document defines:

The base UTXO6-DNS resolution protocol, including VRF-based IID generation, the UTXO RR type, and basic EDNS0 support (Section 2).
Optional PRN extensions: regulatory attributes in UTXO RRs, the PRNAUDIT RR type, EDNS0 option for PRN, PRN-API, MPC audit framework, vLEI integration (Section 3).
A transaction lifecycle compliance enforcement model (AnteHandler) that PRN nodes MAY implement (Section 4).
An informative JSON Schema for AgentPolicyEnvelope, an application-layer policy format (Appendix I).

This document does not specify payment processing, smart contract execution, or blockchain consensus mechanisms. The AgentPolicyEnvelope format is provided as an informative example and is not an IETF standard.

DNSOP Working Group Discussion This document is intended to facilitate early discussion within the DNS Operations (DNSOP) working group. The authors plan to present this proposal in the DNS DISPATCH portion of an upcoming DNSOP meeting, with the goal of collecting feedback on:

Interest in adopting the base UTXO6-DNS protocol as a standards-track document.
Whether the PRN extensions are within the DNSOP charter's scope.
Implementation and deployment considerations.

DNSOP working group mailing list:

Terminology

UTXO: Unspent Transaction Output -- a fundamental unit of value in blockchain systems.
IID: Interface Identifier -- the lower 64 bits of an IPv6 address.
VRF: Verifiable Random Function -- a cryptographic function that produces a random-looking output and a proof that can be verified.
SLAAC: Stateless Address Autoconfiguration -- the IPv6 mechanism for address generation.
PRN: Penetrating Regulation Node -- a node deployed by a regulated entity to implement compliance functions.
vLEI: verifiable Legal Entity Identifier -- a W3C Verifiable Credential for legal entity identity.
MPC: Multi-Party Computation -- cryptographic protocol for threshold signing.
AgentPolicyEnvelope: A JSON structure containing declarative authorization policies for a .utxo domain (e.g., spending limits, asset whitelists). This is an application-layer construct defined informatively in Appendix I.
AnteHandler: A pre-block validation pipeline that enforces compliance checks before a transaction is included in a block.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .