Listed here verbatim are three rock-solid recommendations from ICANN’s Security and Stability Advisory Committee.

Recommendation 1: SSAC recommends that any entity implementing or mandating DNS blocking understand the implications of the technology.

Recommendation 2: SSAC recommends that DNS blocking implemented by any entity — by a government or any organization that has policy, legal, or operational control over a network or service—follow these guidelines:

• A. The entity should determine whether DNS blocking will fulfill its objectives.

• B. The entity should have a clear policy about what and how it will block, with well-defined review and decision-making processes that minimize risk.

• C. The entity should implement the policy using a technique that minimizes overblocking or collateral damage that could affect its users.

• D. The entity should not affect networks or users outside its administrative control.

Recommendation 3: SSAC recommends that operators of recursive servers use DNS Extended Error codes (see section 6.6 Extended DNS Error) to indicate to end users and troubleshooters that DNS blocking is taking place.