Network Working Group                                           J. Gould
Internet-Draft                                                   P. Garg
Intended status: Standards Track                      M.S. Malang Khader
Expires: 21 January 2027                                  VeriSign, Inc.
                                                            20 July 2026


 Status Set Extension Mapping for the Extensible Provisioning Protocol
                  draft-gould-regext-epp-status-set-00

Abstract

   This document describes an Extensible Provisioning Protocol (EPP)
   extension for the provisioning and management of status sets applied
   to EPP objects, such as the domain name object in RFC 5731.  The EPP
   status values defined in the EPP object mappings, such as Section 2.3
   of RFC 5731, support human-readable text that describes the rationale
   or reason for the status applied to the object.  There can be many
   overlapping reasons for a status value being applied to the object,
   such as implementing a lock service, complying with a court order, or
   addressing domain abuse.  A status set defines an object representing
   the reason for setting a list of status values, so clients and
   servers can manage the status sets in place of individual status
   values to effectively manage the overlapping reasons.  The EPP
   extension supports the provisioning of client status sets, disclosure
   of the server status sets, and an enhanced authorization model for
   client status sets with the EPP Authentication Token in draft-gould-
   regext-epp-auth-token.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 21 January 2027.






Gould, et al.            Expires 21 January 2027                [Page 1]

Internet-Draft          EPP Status Set Extension               July 2026


Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
     1.1.  Conventions Used in This Document . . . . . . . . . . . .   3
     1.2.  Registrar User  . . . . . . . . . . . . . . . . . . . . .   4
   2.  Object Attributes . . . . . . . . . . . . . . . . . . . . . .   4
     2.1.  Status Value  . . . . . . . . . . . . . . . . . . . . . .   4
     2.2.  Status Set  . . . . . . . . . . . . . . . . . . . . . . .   5
     2.3.  Authentication Token  . . . . . . . . . . . . . . . . . .   6
     2.4.  M-of-N  . . . . . . . . . . . . . . . . . . . . . . . . .   7
   3.  EPP Command Mapping . . . . . . . . . . . . . . . . . . . . .   7
     3.1.  EPP Query Commands  . . . . . . . . . . . . . . . . . . .   7
       3.1.1.  EPP <check> Command . . . . . . . . . . . . . . . . .   7
       3.1.2.  EPP <info> Command  . . . . . . . . . . . . . . . . .   8
       3.1.3.  EPP <transfer> Command  . . . . . . . . . . . . . . .  17
     3.2.  EPP Transform Commands  . . . . . . . . . . . . . . . . .  17
       3.2.1.  EPP <create> Command  . . . . . . . . . . . . . . . .  18
       3.2.2.  EPP <delete> Command  . . . . . . . . . . . . . . . .  20
       3.2.3.  EPP <renew> Command . . . . . . . . . . . . . . . . .  21
       3.2.4.  EPP <transfer> Command  . . . . . . . . . . . . . . .  22
       3.2.5.  EPP <update> Command  . . . . . . . . . . . . . . . .  24
   4.  Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . .  28
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  31
     5.1.  XML Namespace . . . . . . . . . . . . . . . . . . . . . .  31
     5.2.  EPP Extension Registry  . . . . . . . . . . . . . . . . .  31
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .  32
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  32
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .  32
     7.2.  Informative References  . . . . . . . . . . . . . . . . .  34
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  34







Gould, et al.            Expires 21 January 2027                [Page 2]

Internet-Draft          EPP Status Set Extension               July 2026


1.  Introduction

   This document describes an Extensible Provisioning Protocol (EPP)
   extension for the provisioning and management of status sets applied
   to EPP objects, such as the domain name object in [RFC5731] and the
   host object in [RFC5732].  The EPP status values defined in the EPP
   object mappings, such as Section 2.3 of [RFC5731], support human-
   readable text that describes the rationale or reason for the status
   applied to the object.  There can be many overlapping reasons for a
   status value being applied to the object, such as implementing a lock
   service, complying with a court order, or addressing domain abuse.  A
   status set defines an object representing the reason for setting a
   list of status values, so clients and servers can manage the status
   sets in place of individual status values to effectively manage the
   overlapping reasons.  The EPP extension supports the provisioning of
   client status sets, disclosure of the server status sets, and an
   enhanced authorization model for client status sets with the
   Authentication Token in draft-gould-regext-epp-auth-token.  This
   document defines new EPP commands in the form of the Status Set Info,
   Status Set Create, Status Set Delete, Status Set Renew, and Status
   Set Update.

   This document describes a Status Set Extension Mapping for version
   1.0 of the Extensible Provisioning Protocol (EPP) [RFC5730].  This
   extension is specified using the XML 1.0 as described in
   [W3C.REC-xml-20040204] and XML Schema notation as described in
   [W3C.REC-xmlschema-1-20041028] and [W3C.REC-xmlschema-2-20041028].

1.1.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   [BCP14] when, and only when, they appear in all capitals, as shown
   here.

   In examples, "C:" represents lines sent by a protocol client and "S:"
   represents lines returned by a protocol server.  Indentation and
   white space in examples is provided only to illustrate element
   relationships and is not a REQUIRED feature of this specification.

   XML is case sensitive.  Unless stated otherwise, XML specifications
   and examples provided in this document MUST be interpreted in the
   character case presented to develop a conforming implementation.







Gould, et al.            Expires 21 January 2027                [Page 3]

Internet-Draft          EPP Status Set Extension               July 2026


   The XML namespace prefix "statusSet" is used for the namespace
   "urn:ietf:params:xml:ns:epp:statusSet-0.1", but implementations MUST
   NOT depend on it; instead, they should employ a proper namespace-
   aware XML parser and serializer to interpret and output the XML
   documents.

1.2.  Registrar User

   [RFC8499] defines the registrar as "a service provider that acts as a
   go-between for registrants and registries." and defines the
   registrant and registry.  A registrar can have many users that
   interface with the registry across many channels, such as EPP and Web
   User Interface (UI), which is referred to as a Registrar User in this
   document.  The EPP client in [RFC5730], referred to as the EPP
   Registrar User is this document, is a registrar system that uses the
   EPP Registrar User credentials to authenticate with the <login>
   command to establish an EPP session.  The Registrar User
   authenticates to create the Authentication Token, defined in draft-
   gould-regext-epp-auth-token, that MUST NOT be the EPP Registrar User
   since the EPP Registrar User is used only to create the EPP session.
   The ability to provision Status Sets using an Authentication Token is
   based on enabling a Registrar User to generate an Authentication
   Token and having the required set of authorization groups to
   authorize a Status Set action.

2.  Object Attributes

   This extension adds additional elements to EPP objects, such as the
   domain name mapping described in [RFC5731] and the host mapping
   described in [RFC5732].  Common attributes are described here.

2.1.  Status Value

   A Status Value is defined for EPP objects in the EPP extensions, such
   as Status Values in Section 2.3 of [RFC5731] and Section 3.1 of
   [RFC3915].  There is a single Status Value assigned to an object by
   type, such as the "clientUpdateProhibited" Status Value in [RFC5731]
   and the "redemptionPeriod" Status Value in [RFC3915].  The Status
   Value can include a text message indicating the reason(s) that the
   Status Value is set, such as:

   <domain:status s="clientUpdateProhibited">
   Auth Token Lock,Registrar Lock
   </domain:status>







Gould, et al.            Expires 21 January 2027                [Page 4]

Internet-Draft          EPP Status Set Extension               July 2026


   Inclusion and format of the Status Value reason(s) is specific to
   each server implemenation, and the client needs to implement the
   server-specific format.  The Status Set, described in Section 2.2,
   makes the reason string into a named object with a set of attributes,
   including the associated Status Values.

2.2.  Status Set

   A Status Set is an object that defines the reason for the Status
   Values (Section 2.1) for an EPP object, such as the domain name
   object in [RFC5731] and the host object in [RFC5732].  The Status Set
   can also be used as a Marker Status Set when there are no mapped
   Status Values that can drive additional business logic and publishing
   use cases.  An EPP object can have many assigned Status Sets, and the
   Status Sets can include an overlapping set of Status Values.  The
   Status Value will be assigned to the object if there is at least one
   Status Set assigned to the object with the mapped Status Value.  The
   Status Value will be unassigned from the object when all Status Sets
   are unassigned with the mapped Status Value.  For example, both the
   "Registrar Lock" Status Set and the "Auth Token Lock" Status Set are
   mapped to the "clientUpdateProhibited" Status Value, where if either
   of the Status Sets are assigned to the EPP object, the
   "clientUpdateProhibited" Status Value will be assigned.
   "clientUpdateProhibited" Status Value will be unassigned if both
   "Registrar Lock" Status Set and "Auth Token Lock" Status Sets are
   unassigned.  A Status Set has the following attributes:

   *  "name": The unique name for the Status Set that is up to server
      policy.  The reserved name "REDACTED" can be used for a Server
      Status Set where the server cannot disclose the reason, such as
      the case for a sealed court order.  Example names include
      "Registrar Lock", "Auth Token Lock", and "Registry Lock".

   *  "type": The type of Status Set, which is either "client" for a
      Client Status Set or "server" for a Server Status Set.  A Client
      Status Set MAY be set, unset, and overridden with authorization
      defined in the Authentication Token (Section 2.3) by the client.
      A Server Status Set MUST only be set and unset by the server and
      MUST NOT be overridden by the client.

   *  "authTokenUsed": A boolean value indicating whether or not an
      Authentication Token (Section 2.3) is used with the Client Status
      Set.  If "true", an Authentication Token (Section 2.3) is needed
      to authorize setting, unsetting, and overriding the Client Status
      Set; otherwise the Authentication Token (Section 2.3) does not
      need to be passed.  This value MUST be set only when the "type"
      attribute is set to "client".




Gould, et al.            Expires 21 January 2027                [Page 5]

Internet-Draft          EPP Status Set Extension               July 2026


   *  "inherited": A boolean value indicating whether or not the Status
      Set is inherited from the parent object (domain name) and is
      inherited by the child objects (hosts).  The Status Values of the
      object only include Status Sets directly assigned and not
      inherited by the object.  Inherited Status Values are enforced by
      the server but NOT persisted to the child object.

   *  "assigned": A boolean value indicating whether or not the Status
      Set is directly assigned to the object.  The <info> command
      supports returning "all" Status Sets for the client to see what
      Client Status Sets are available and directly assigned to the
      object.  Only "assigned" Server Status Sets will be returned in
      the <info> response extension.

   *  "crDate": Date and time that the Status Set was assigned to the
      EPP object.

   *  "status": List of 0 or more Status Values (Section 2.1) mapped to
      the Status Set.  A Status Set with zero Status Values is
      considered a Marker Status Set.  Example Status Values include the
      lock statuses from [RFC5731] and [RFC5732] with
      "clientUpdateProhibited", "clientDeleteProhibited",
      "clientTransferProhibited", "serverUpdateProhibited",
      "serverDeleteProhibited", and "serverTransferProhibited".

   *  "reason": Reason that the Status Set was assigned to the object.
      This is only needed when the "name" attribute alone doesn't
      clearly indicate the reason.  An example is providing the more
      detailed reason "Botnet domain name" for the "Domain Abuse" Status
      Set.

   A client can manage Client Status Values using Client Status Sets
   instead of setting individual Client Status Values, since the Status
   Set represents a container of Status Values that can overlap.  The
   Status Set provides an explicit signal of the Status Value reasons
   that improves the status management when there are overlapping
   reasons.  The support for the Authentication Token (Section 2.3)
   provides an additional layer of authorization with the ability to
   override Client Status Sets in Status Set transform commands.

2.3.  Authentication Token

   The Authentication Token, defined in section 2.1 of draft-gould-
   regext-epp-auth-token, uses JSON Web Signature (JWS), defined in
   [RFC7515], with JWS Compact Serialization, defined in Section 3.1 of
   [RFC7515], to digitally sign the JWS Protected Header properties and
   JWS Payload claims in a single string that is embedded in the
   <statusSet:authToken> XML element.  An Authentication Token is used



Gould, et al.            Expires 21 January 2027                [Page 6]

Internet-Draft          EPP Status Set Extension               July 2026


   to authorize provisioning and overriding a Client Status Set that has
   the <statusSet:authTokenUsed> element set to "1" or "true" in the
   Status Set Info Response (Section 3.1.2).  The overriding capability
   MUST only apply to Client Status Sets.

   Example Authentication Token XML element:

         <statusSet:authToken>
   eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
         </statusSet:authToken>

2.4.  M-of-N

   M-of-N applies to the use of Authentication Tokens (Section 2.3),
   where M defines the number of registrar users (Section 1.2) with a
   valid Authentication Token (Section 2.3) needed to authorize a Status
   Set action out of N registrar users (Section 1.2) that can generate
   an Authentication Token.  The Status Set transform commands support
   providing a list of Authentication Tokens (Section 2.3), using the
   <statusSet:authToken> elements.  The value of M is up to server
   policy and can be at the server-level that applies to all registrars
   or can apply at the registrar-level and configured on a per-registrar
   basis.  The value of N is dynamic and is based on the number of
   registrar users (Section 1.2) that support the generation of
   Authentication Tokens (Section 2.3) in the server.

3.  EPP Command Mapping

   A detailed description of the EPP syntax and semantics can be found
   in the EPP core protocol specification [RFC5730].

3.1.  EPP Query Commands

   This document defines one EPP Query Command with <info> to retrieve
   the Status Set information for the object.  This document does not
   define a mapping for the EPP <check> command or the <transfer>
   command.

3.1.1.  EPP <check> Command

   This extension does not add any elements to the EPP <check> command
   or <check> response.



Gould, et al.            Expires 21 January 2027                [Page 7]

Internet-Draft          EPP Status Set Extension               July 2026


3.1.2.  EPP <info> Command

   A new Status Set Info Command by extending the EPP <info> command to
   get information for an EPP object with the inclusion of the Status
   Set information, defined in Section 2.2, that is optionally
   authorized by applying the Authentication Tokens and their
   authorization groups, defined in Section 2.3.

   In addition to the EPP command elements described in the EPP <info>
   command, the command MAY contain an <extension> element.  The
   <extension> element MUST contain a child <statusSet:info> element
   with an OPTIONAL "sets" attribute that can be either "assigned" or
   "all", with "assigned" being the default value.  The value "assigned"
   can be used to return the Status Sets directly assigned to or
   inherited by the EPP object, and "all" to return the Status Sets that
   are assigned to and available for the EPP object.  The
   <statusSet:info> element contains the following child elements:

   *  An OPTIONAL list of <statusSet:authToken> elements, defined in
      Section 2.3, that supports authorizing the data returned in the
      Status Set Info Response in support of M-of-N authorization,
      defined in Section 2.4.  The authorization groups in the list of
      Authentication Tokens (Section 2.3) are intersected to determine
      the data that will be returned.  If no <statusSet:authToken>
      elements are provided, the server will return the default data
      based on the EPP Registrar User (Section 1.2) authorization of the
      EPP session.

   Example Domain Name Status Set Info Command that uses the default
   "assigned" form:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp
   C:  xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <info>
   C:      <domain:info
   C:        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>domain.example</domain:name>
   C:      </domain:info>
   C:    </info>
   C:   <extension>
   C:      <statusSet:info
   C:      xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1"/>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>



Gould, et al.            Expires 21 January 2027                [Page 8]

Internet-Draft          EPP Status Set Extension               July 2026


   Example Domain Name Status Set Info Command that uses the "assigned"
   form with two authentication tokens to determine the data returned:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp
   C:  xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <info>
   C:      <domain:info
   C:        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>domain.example</domain:name>
   C:      </domain:info>
   C:    </info>
   C:    <extension>
   C:      <statusSet:info
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1"
   C:        sets="assigned">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:authToken>
   C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ
   C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp
   C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk
   C:        </statusSet:authToken>
   C:      </statusSet:info>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example Domain Name Status Set Info Command that uses the "all" form:













Gould, et al.            Expires 21 January 2027                [Page 9]

Internet-Draft          EPP Status Set Extension               July 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp
   C:  xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <info>
   C:      <domain:info
   C:        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>domain.example</domain:name>
   C:      </domain:info>
   C:    </info>
   C:    <extension>
   C:      <statusSet:info
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1"
   C:        sets="all"/>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   If the query was successful, the server replies with a
   <statusSet:infData> element along with the regular EPP <resData>.
   The <statusSet:infData> contains the following child elements:

   *  A <statusSet:name> element that includes the unique name for the
      Status Set that is up to server policy.  Example names include
      "Registrar Lock", "Auth Token Lock", and "Registry Lock".  There
      is a reserved value of "REDACTED" that is used for a Server Status
      Set, where the name must be redacted based on server policy.

   *  A <statusSet:type> element that indicates whether the Status Set
      is a Client Status Set with a value of "client" or the Status Set
      is a Server Status Set with a value of "server".

   *  An OPTIONAL <statusSet:authTokenUsed> element that is a boolean
      with a default value of "false" that indicates whether the Status
      Set uses the Authentication Token, defined in Section 2.3.  If "1"
      or "true", an Authentication Token is needed to authorize the
      setting, unsetting, and overriding the Client Status Set;
      otherwise with a value of "0" or "false" the Authentication Token
      does not need to be passed.  An OPTIONAL "num" attribute, with a
      default value of "1", indicates the M value in M-of-N, defined in
      Section 2.4.









Gould, et al.            Expires 21 January 2027               [Page 10]

Internet-Draft          EPP Status Set Extension               July 2026


   *  An OPTIONAL <statusSet:inherited> element that is a boolean with a
      default value of "false" that indicates whether the Status Set is
      inherited from the parent object (domain name), in the case of the
      EPP Host object in [RFC5732], and is inherited by the child
      objects (hosts), in the case of the EPP Domain Name object in
      [RFC5731].

   *  An OPTIONAL <statusSet:assigned> element that is a boolean with a
      default value of "true" that indicates whether the Status Set is
      assigned to the EPP object.  A value of "false" indicates that the
      Status Set is available to be set, which only applies to Client
      Status Sets.

   *  An OPTIONAL <statusSet:crDate> element that is the date and time
      that the Status Set was assigned to the object.

   *  An OPTIONAL list of zero or more <statusSet:status> elements that
      includes the Status Values, defined in Section 2.1 mapped to the
      Status Set.

   *  An OPTIONAL <statusSet:reason> element that indicates the freefrom
      text reason that Status Set was assigned to the object.

   Example Domain Name Status Set Info Response that includes the
   assigned Client Status Sets ("Auth Token Lock" and "Registrar Lock")
   and the assigned Server Status Set ("Registry Lock"):

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="clientUpdateProhibited">
   S:       Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientDeleteProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientTransferProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="serverUpdateProhibited">



Gould, et al.            Expires 21 January 2027               [Page 11]

Internet-Draft          EPP Status Set Extension               July 2026


   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverDeleteProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverTransferProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns1.example.net</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>2000-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>2026-05-03T09:10:00.0Z</domain:upDate>
   S:        <domain:exDate>2027-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2022-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <statusSet:infData
   S:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   S:        <statusSet:statusSet>
   S:          <statusSet:name>Auth Token Lock</statusSet:name>
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>true</statusSet:authTokenUsed>
   S:          <statusSet:inherited>true</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet>
   S:          <statusSet:name>Registrar Lock</statusSet:name>
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>



Gould, et al.            Expires 21 January 2027               [Page 12]

Internet-Draft          EPP Status Set Extension               July 2026


   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:        <statusSet:statusSet>
   S:          <statusSet:name>Registry Lock</statusSet:name>
   S:          <statusSet:type>server</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:10:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>serverUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:      </statusSet:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

   Example Domain Name Status Set Info Response with the "all" form that
   includes the two assigned Client Status Sets ("Registrar Lock", "Auth
   Token Lock"), the two assigned Server Status Sets ("Registry Lock"
   and the reserved "REDACTED"), and the available Client Status Set
   ("Registrar Court Order Lock"):

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>



Gould, et al.            Expires 21 January 2027               [Page 13]

Internet-Draft          EPP Status Set Extension               July 2026


   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="clientUpdateProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientDeleteProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientTransferProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="serverUpdateProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverDeleteProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverTransferProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverHold">
   S:        REDACTED
   S:        </domain:status>
   S:        <domain:ns>
   S:         <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns1.example.net</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>2000-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>2026-05-03T09:10:00.0Z</domain:upDate>
   S:        <domain:exDate>2027-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2022-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <statusSet:infData
   S:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   S:        <statusSet:statusSet>
   S:          <statusSet:name>Auth Token Lock</statusSet:name>



Gould, et al.            Expires 21 January 2027               [Page 14]

Internet-Draft          EPP Status Set Extension               July 2026


   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>true</statusSet:authTokenUsed>
   S:          <statusSet:inherited>true</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z<
   S:            /statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet>
   S:          <statusSet:name>Registrar Lock</statusSet:name>
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:        <statusSet:statusSet>
   S:          <statusSet:name>Registry Lock</statusSet:name>
   S:          <statusSet:type>server</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:10:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>serverUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:        <statusSet:statusSet>
   S:          <statusSet:name>REDACTED</statusSet:name>
   S:          <statusSet:type>server</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>



Gould, et al.            Expires 21 January 2027               [Page 15]

Internet-Draft          EPP Status Set Extension               July 2026


   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-01T10:11:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>serverHold</statusSet:status>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet>
   S:          <statusSet:name>Registrar Court Order Lock
   S:          </statusSet:name>
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>false</statusSet:assigned>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:      </statusSet:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

   Example Host Status Set Info Response that includes an the inherited
   Client Status Set ("Auth Token Lock") from the parent domain name:

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <host:infData
   S:       xmlns:host="urn:ietf:params:xml:ns:host-1.0">
   S:        <host:name>ns1.example.com</host:name>
   S:        <host:roid>NS1_EXAMPLE1-REP</host:roid>
   S:        <host:status s="ok"/>
   S:        <host:addr ip="v4">192.0.2.2</host:addr>
   S:        <host:addr ip="v4">192.0.2.29</host:addr>
   S:        <host:addr ip="v6">1080:0:0:0:8:800:200C:417A</host:addr>
   S:        <host:clID>ClientY</host:clID>
   S:        <host:crID>ClientX</host:crID>



Gould, et al.            Expires 21 January 2027               [Page 16]

Internet-Draft          EPP Status Set Extension               July 2026


   S:        <host:crDate>2000-04-03T22:00:00.0Z</host:crDate>
   S:        <host:upID>ClientX</host:upID>
   S:        <host:upDate>2026-05-03T09:00:00.0Z</host:upDate>
   S:        <host:trDate>2022-04-08T09:00:00.0Z</host:trDate>
   S:      </host:infData>
   S:    </resData>
   S:    <extension>
   S:      <statusSet:infData
   S:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   S:        <statusSet:statusSet>
   S:          <statusSet:name>Auth Token Lock</statusSet:name>
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>true</statusSet:authTokenUsed>
   S:          <statusSet:inherited>true</statusSet:inherited>
   S:          <statusSet:assigned>false</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:      </statusSet:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

3.1.3.  EPP <transfer> Command

   This extension does not add any elements to the EPP <transfer> query
   command or <transfer> query response.

3.2.  EPP Transform Commands

   This document defines a new EPP Status Set Command for each of the
   EPP Transform Commands, defined in [RFC5730], to enable the
   provisioning of the Client Status Sets in the <create> and <update>
   commands and the overriding of the Client Status Sets with the
   passing of one or more Authentication Tokens in each of the EPP
   Status Set Transform Commands.  An example is the definition of the
   EPP Domain Status Set Update Command in Section 3.2.5 extending the
   domain name <update> command in [RFC5731].



Gould, et al.            Expires 21 January 2027               [Page 17]

Internet-Draft          EPP Status Set Extension               July 2026


3.2.1.  EPP <create> Command

   A new Status Set Create Command by extending the EPP <create> command
   to create an EPP object, such as the domain name in [RFC5731] or a
   host in [RFC5732], with a list of Status Sets (Section 2.2) that will
   be assigned initially.  In addition to the EPP command elements
   described in the EPP <create> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:create> element that contains the following child
   elements:

   *  An OPTIONAL list of <statusSet:authToken> elements, defined in
      Section 2.3, that supports authorizing the assigning of the Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   *  One or more <statusSet:statusSet> elements that include the unique
      name of the Status Set, defined in Section 2.2.

   Example Domain Name Status Set Create Command that sets the
   "Registrar Lock" Status Set:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:      xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.net</domain:hostObj>
   C:          <domain:hostObj>ns2.example.net</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <statusSet:create
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:statusSet>Registrar Lock</statusSet:statusSet>
   C:      </statusSet:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>




Gould, et al.            Expires 21 January 2027               [Page 18]

Internet-Draft          EPP Status Set Extension               July 2026


   Example Domain Name Status Set Create Command that sets the
   "Registrar Lock" Status Set and the "Auth Token Lock", which includes
   2 Authentication Tokens to meet an M value of 2, in M-of-N:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:      xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.net</domain:hostObj>
   C:          <domain:hostObj>ns2.example.net</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <statusSet:create
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:authToken>
   C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ
   C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp
   C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk
   C:        </statusSet:authToken>
   C:        <statusSet:statusSet>Registrar Lock</statusSet:statusSet>
   C:        <statusSet:statusSet>Auth Token Lock</statusSet:statusSet>
   C:      </statusSet:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>






Gould, et al.            Expires 21 January 2027               [Page 19]

Internet-Draft          EPP Status Set Extension               July 2026


   This extension does not define any extension to the response of a
   <create> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.1 of [RFC5731].

3.2.2.  EPP <delete> Command

   A new Status Set Delete Command by extending the EPP <delete> command
   to delete an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <delete> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:delete> element that contains the following child
   elements:

   *  One or more <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   Example Domain Name Status Set Delete Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   the delete:



























Gould, et al.            Expires 21 January 2027               [Page 20]

Internet-Draft          EPP Status Set Extension               July 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <delete>
   C:      <domain:delete
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:delete>
   C:    </delete>
   C:    <extension>
   C:      <statusSet:delete
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:delete>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   This extension does not define any extension to the response of an
   <delete> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.2 of [RFC5731].

3.2.3.  EPP <renew> Command

   A new Status Set Renew Command by extending the EPP <renew> command
   to renew an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <renew> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:renew> element that contains the following child elements:

   *  One or more <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.





Gould, et al.            Expires 21 January 2027               [Page 21]

Internet-Draft          EPP Status Set Extension               July 2026


   Example Domain Name Status Set Renew Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   the renew:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <renew>
   C:      <domain:renew
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:curExpDate>2026-04-03</domain:curExpDate>
   C:        <domain:period unit="y">5</domain:period>
   C:      </domain:renew>
   C:    </renew>
   C:    <extension>
   C:      <statusSet:renew
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:     </statusSet:renew>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   This extension does not define any extension to the response of an
   <renew> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.3 of [RFC5731].

3.2.4.  EPP <transfer> Command

   A new Status Set Transfer Command by extending the EPP <transfer>
   command to transfer an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <transfer> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:transfer> element that contains the following child



Gould, et al.            Expires 21 January 2027               [Page 22]

Internet-Draft          EPP Status Set Extension               July 2026


   elements:

   *  One or more <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   Example Domain Name Status Set Transfer Command that includes a
   single Authentication Token (M = 1 with M-of-N authorization) to
   authorize the transfer:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <transfer op="request">
   C:      <domain:transfer
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">1</domain:period>
   C:        <domain:authInfo>
   C:          <domain:pw roid="JD1234-REP">2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:transfer>
   C:    </transfer>
   C:    <extension>
   C:      <statusSet:transfer
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:transfer>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   This extension does not define any extension to the response of an
   <transfer> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.4 of [RFC5731].






Gould, et al.            Expires 21 January 2027               [Page 23]

Internet-Draft          EPP Status Set Extension               July 2026


3.2.5.  EPP <update> Command

   A new Status Set Update Command by extending the EPP <update> command
   to transfer an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <update> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:update> element that contains the following child
   elements:

   *  An OPTIONAL list of <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   *  An OPTIONAL <statusSet:add> element that includes zero or more
      <statusSet:statusSet> elements that includes the unique name of
      the Status Set, defined in Section 2.2, to add to the EPP object.

   *  An OPTIONAL <statusSet:rem> element that includes zero or more
      <statusSet:statusSet> elements that includes the unique name of
      the Status Set, defined in Section 2.2, to remove from the EPP
      object.  The Status Set removes MUST be processed prior to the
      adds.

   Example Domain Name Status Set Update Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   the update:






















Gould, et al.            Expires 21 January 2027               [Page 24]

Internet-Draft          EPP Status Set Extension               July 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:add>
   C:          <domain:ns>
   C:            <domain:hostObj>ns2.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:add>
   C:        <domain:rem>
   C:          <domain:ns>
   C:            <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:rem>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example Domain Name Status Set Update Command that includes a two
   Authentication Tokens (M = 2 with M-of-N authorization) to authorize
   the update:






Gould, et al.            Expires 21 January 2027               [Page 25]

Internet-Draft          EPP Status Set Extension               July 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:add>
   C:          <domain:ns>
   C:            <domain:hostObj>ns2.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:add>
   C:        <domain:rem>
   C:          <domain:ns>
   C:            <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:rem>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:authToken>
   C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ
   C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp
   C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk
   C:        </statusSet:authToken>
   C:       </statusSet:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>





Gould, et al.            Expires 21 January 2027               [Page 26]

Internet-Draft          EPP Status Set Extension               July 2026


   Example Domain Name Status Set Update Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   removing the "Auth Token Lock" Status Set and adding the "Auth Token
   Lock - Transfer Allowed" Status Set, which removes the
   "clientTransferProhibited" Status Value from the domain name and
   keeps the "clientUpdateProhibited" and "clientDeleteProhibited"
   Status Values:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:     <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:       <domain:chg/>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.1">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:add>
   C:          <statusSet:statusSet>Auth Token Lock - Transfer Allowed
   C:          </statusSet:statusSet>
   C:        </statusSet:add>
   C:        <statusSet:rem>
   C:          <statusSet:statusSet>Auth Token Lock
   C:          </statusSet:statusSet>
   C:        </statusSet:rem>
   C:      </statusSet:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>



Gould, et al.            Expires 21 January 2027               [Page 27]

Internet-Draft          EPP Status Set Extension               July 2026


   This extension does not define any extension to the response of an
   <update> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.4 of [RFC5731].

4.  Formal Syntax

   An EPP object mapping is specified in XML Schema notation.  The
   formal syntax presented here is a complete schema representation of
   the object mapping suitable for automated validation of EPP XML
   instances.  The BEGIN and END tags are not part of the schema; they
   are used to note the beginning and ending of the schema for URI
   registration purposes.

   BEGIN
   <?xml version="1.0" encoding="UTF-8"?>
   <schema
     targetNamespace=
       "urn:ietf:params:xml:ns:epp:statusSet-0.1"
     xmlns:statusSet=
       "urn:ietf:params:xml:ns:epp:statusSet-0.1"
     xmlns="http://www.w3.org/2001/XMLSchema"
     elementFormDefault="qualified">

     <annotation>
       <documentation>
         Extensible Provisioning Protocol v1.0
         Status Set Extension.
       </documentation>
     </annotation>

     <!-- status set info command element -->
     <element name="info" type="statusSet:infoType"/>

     <complexType name="infoType">
       <simpleContent>
         <extension base="statusSet:authTokenListType">
           <attribute name="sets"
           type="statusSet:setsEnum" default="assigned"/>
         </extension>
       </simpleContent>
     </complexType>

     <simpleType name="setsEnum">
       <restriction base="token">
         <enumeration value="assigned"/>
         <enumeration value="all"/>
       </restriction>



Gould, et al.            Expires 21 January 2027               [Page 28]

Internet-Draft          EPP Status Set Extension               July 2026


     </simpleType>


     <!-- status set info response element -->
     <element name="infData" type="statusSet:infDataType"/>

     <complexType name="infDataType">
       <sequence>
         <element name="statusSet"
           type="statusSet:statusSetDataType"
           minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

     <complexType name="statusSetDataType">
       <sequence>
         <element name="name" type="token"/>
         <element name="type" type="statusSet:statusSetTypeEnum"/>
         <element name="authTokenUsed"
           type="statusSet:authTokenUsedType"
           minOccurs="0" default="false"/>
         <element name="inherited" type="boolean"
           minOccurs="0" default="false"/>
         <element name="assigned" type="boolean"
           minOccurs="0" default="true"/>
         <element name="crDate" type="dateTime"
           minOccurs="0"/>
         <element name="status" type="token"
           minOccurs="0" maxOccurs="unbounded"/>
         <element name="reason" type="token"
           minOccurs="0"/>
       </sequence>
     </complexType>

     <complexType name="authTokenUsedType">
       <simpleContent>
         <extension base="boolean">
           <attribute name="num"
           type="int" default="1"/>
         </extension>
       </simpleContent>
     </complexType>

     <simpleType name="statusSetTypeEnum">
       <restriction base="token">
         <enumeration value="client"/>
         <enumeration value="server"/>
       </restriction>



Gould, et al.            Expires 21 January 2027               [Page 29]

Internet-Draft          EPP Status Set Extension               July 2026


     </simpleType>

     <!-- authentication token -->
     <simpleType name="authTokenType">
       <restriction base="token">
       <pattern value="[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+"/>
       </restriction>
     </simpleType>

    <complexType name="authTokenListType">
       <sequence>
         <element name="authToken" type="statusSet:authTokenType"
         minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
     </complexType>


     <!-- status set create command element -->
     <element name="create" type="statusSet:createType"/>

     <complexType name="createType">
       <sequence>
         <element name="authToken" type="statusSet:authTokenType"
         minOccurs="0" maxOccurs="unbounded"/>
         <element name="statusSet" type="token"
         minOccurs="1" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

     <!-- status set delete command element -->
     <element name="delete" type="statusSet:authTokenListType"/>

     <!-- status set renew command element -->
     <element name="renew" type="statusSet:authTokenListType"/>

     <!-- status set transfer command element -->
     <element name="transfer" type="statusSet:authTokenListType"/>

     <!-- status set update command element -->
     <element name="update" type="statusSet:updateType"/>

     <complexType name="updateType">
       <sequence>
         <element name="authToken" type="statusSet:authTokenType"
          minOccurs="0" maxOccurs="unbounded"/>
         <element name="add" type="statusSet:addRemType"
          minOccurs="0"/>
         <element name="rem" type="statusSet:addRemType"



Gould, et al.            Expires 21 January 2027               [Page 30]

Internet-Draft          EPP Status Set Extension               July 2026


          minOccurs="0"/>
       </sequence>
     </complexType>

     <complexType name="addRemType">
       <sequence>
         <element name="statusSet" type="token"
          minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

   </schema>
   END

5.  IANA Considerations

5.1.  XML Namespace

   This document uses URNs to describe XML namespaces and XML schemas
   conforming to a registry mechanism described in [RFC3688].  The
   following URI assignment has been made by IANA:

   Registration request for the Status Set Extension Mapping namespace:

   URI:  urn:ietf:params:xml:ns:epp:statusSet-0.1
   Registrant Contact:  Registrant Contact: IESG
   XML:  None.  Namespace URIs do not represent an XML specification.

   Registration request for the Status Set Extension Mapping XML Schema:

   URI:  urn:ietf:params:xml:schema:epp:statusSet-0.1
   Registrant Contact:  Registrant Contact: IESG
   XML:  See the "Formal Syntax" section of this document.

5.2.  EPP Extension Registry

   The EPP extension described in this document has been registered by
   IANA in the "Extensions for the Extensible Provisioning Protocol
   (EPP)" registry described in [RFC7451].  The details of the
   registration are as follows:

   Name of Extension:  "Status Set Extension Mapping for the Extensible
      Provisioning Protocol"
   Document Status:  Standards Track
   Reference:  (insert reference to RFC version of this document)
   Registrant Name and Email Address:  IESG, <iesg@ietf.org>
   TLDs:  Any
   IPR Disclosure:  None



Gould, et al.            Expires 21 January 2027               [Page 31]

Internet-Draft          EPP Status Set Extension               July 2026


   Status:  Active
   Notes:  None

6.  Security Considerations

   The mapping extensions described in this document extends the
   security services described by EPP [RFC5730] and protocol layers used
   by EPP by using an Authentication Token, in draft-gould-regext-epp-
   auth-token, that is passed on top of EPP for registrar users to
   perform more fine grained authorization in the form of overriding a
   Client Status Set.

   The security considerations for the server include:

   1.  The Server Status Sets and the associated Server Status Values
       can only be managed by the server.  The server MUST NOT allow the
       client to set, unset, or override a Server Status Set.

   2.  The authorization model for a server operation is driven by the
       mapping of the Status Values to the asasigned Status Sets.  The
       server applies the Authentication Token, in draft-gould-regext-
       epp-auth-token, by matching the operation, the entitlements in
       the Authentication Token, and the assigned Client Status Sets to
       determine which Client Status Sets are overriden to authorize the
       execution of the operation.

   3.  Applying the inherited Client Staus Sets to the child objects
       (child host for parent domain name) MAY be enforced by the server
       business logic without having to directly change the child
       objects.  There can be an unlimited number of child objects, so
       there is a resource consumption issue associated with cascading
       inherited Status Sets directly to the child objects.

   4.  Implementing the M-of-N authorization performs a intersection of
       the "entitlements" in the Authentication Tokens, in draft-gould-
       regext-epp-auth-token, when authorizing a Status Set Command.

   The security considerations for the client include:

   1.  There are no additional client security considerations other than
       what's defined for the Authentication Token in draft-gould-
       regext-epp-auth-token.

7.  References

7.1.  Normative References





Gould, et al.            Expires 21 January 2027               [Page 32]

Internet-Draft          EPP Status Set Extension               July 2026


   [BCP14]    Best Current Practice 14,
              <https://www.rfc-editor.org/info/bcp14>.
              At the time of writing, this BCP comprises the following:

              Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

              Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
              DOI 10.17487/RFC3688, January 2004,
              <https://www.rfc-editor.org/info/rfc3688>.

   [RFC3915]  Hollenbeck, S., "Domain Registry Grace Period Mapping for
              the Extensible Provisioning Protocol (EPP)", RFC 3915,
              DOI 10.17487/RFC3915, October 2004,
              <https://www.rfc-editor.org/info/rfc3915>.

   [RFC5730]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)",
              STD 69, RFC 5730, DOI 10.17487/RFC5730, August 2009,
              <https://www.rfc-editor.org/info/rfc5730>.

   [RFC5731]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)
              Domain Name Mapping", STD 69, RFC 5731,
              DOI 10.17487/RFC5731, August 2009,
              <https://www.rfc-editor.org/info/rfc5731>.

   [RFC5732]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)
              Host Mapping", STD 69, RFC 5732, DOI 10.17487/RFC5732,
              August 2009, <https://www.rfc-editor.org/info/rfc5732>.

   [RFC7515]  Jones, M., Bradley, J., and N. Sakimura, "JSON Web
              Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May
              2015, <https://www.rfc-editor.org/info/rfc7515>.

   [RFC8499]  Hoffman, P., Sullivan, A., and K. Fujiwara, "DNS
              Terminology", RFC 8499, DOI 10.17487/RFC8499, January
              2019, <https://www.rfc-editor.org/info/rfc8499>.









Gould, et al.            Expires 21 January 2027               [Page 33]

Internet-Draft          EPP Status Set Extension               July 2026


   [W3C.REC-xml-20040204]
              Bray, T., Paoli, J., Sperberg-McQueen, C., Maler, E., and
              F. Yergeau, ""Extensible Markup Language (XML) 1.0 (Third
              Edition)", World Wide Web Consortium FirstEdition REC-xml-
              20040204", February 2004,
              <http://www.w3.org/TR/2004/REC-xml-20040204>.

   [W3C.REC-xmlschema-1-20041028]
              Thompson, H., Beech, D., Maloney, M., and N. Mendelsohn,
              ""XML Schema Part 1: Structures Second Edition", World
              Wide Web Consortium Recommendation REC-xmlschema-
              1-20041028", October 2004,
              <http://www.w3.org/TR/2004/REC-xmlschema-1-20041028>.

   [W3C.REC-xmlschema-2-20041028]
              Biron, P. and A. Malhotra, ""XML Schema Part 2: Datatypes
              Second Edition", World Wide Web Consortium Recommendation
              REC-xmlschema-2-20041028", October 2004,
              <http://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.

7.2.  Informative References

   [RFC7451]  Hollenbeck, S., "Extension Registry for the Extensible
              Provisioning Protocol", RFC 7451, DOI 10.17487/RFC7451,
              February 2015, <https://www.rfc-editor.org/info/rfc7451>.

Authors' Addresses

   James Gould
   VeriSign, Inc.
   12061 Bluemont Way
   Reston, VA 20190
   United States of America
   Email: jgould@verisign.com
   URI:   http://www.verisign.com


   Poonam Garg
   VeriSign, Inc.
   12061 Bluemont Way
   Reston, VA 20190
   United States of America
   Email: pogarg@verisign.com
   URI:   http://www.verisign.com







Gould, et al.            Expires 21 January 2027               [Page 34]

Internet-Draft          EPP Status Set Extension               July 2026


   Mohammad Suhale Malang Khader
   VeriSign, Inc.
   12061 Bluemont Way
   Reston, VA 20190
   United States of America
   Email: mmalangkhader@verisign.com
   URI:   http://www.verisign.com












































Gould, et al.            Expires 21 January 2027               [Page 35]