diff --git a/classify/rules.go b/classify/rules.go
index da7b919..a60061d 100644
--- a/classify/rules.go
+++ b/classify/rules.go
@@ -11,18 +11,68 @@ type Rule struct {
 
 // DefaultRules is the D-01 protocol map — ordered, first-match-wins.
 // Per D-02: config-driven slice, not a switch statement.
+// 42 rules total: 12 existing + 30 new (PROTO-01 through PROTO-08).
+// Catch-all rules (DstPort: 0) MUST remain as the final two entries (D-06).
 var DefaultRules = []Rule{
+	// --- Infrastructure ---
 	{Protocol: "icmp", DstPort: 0, Class: ClassICMP},
 	{Protocol: "udp", DstPort: 53, Class: ClassDNS},
 	{Protocol: "tcp", DstPort: 53, Class: ClassDNS},
-	{Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
-	{Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
-	{Protocol: "tcp", DstPort: 22, Class: ClassSSH},
-	{Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
 	{Protocol: "udp", DstPort: 123, Class: ClassNTP},
 	{Protocol: "udp", DstPort: 67, Class: ClassDHCP},
 	{Protocol: "udp", DstPort: 68, Class: ClassDHCP},
-	// Catch-alls (must be last):
+
+	// --- Discovery (PROTO-05) ---
+	{Protocol: "udp", DstPort: 5353, Class: ClassMDNS},
+	{Protocol: "udp", DstPort: 1900, Class: ClassSSDP},
+	{Protocol: "udp", DstPort: 161, Class: ClassSNMP},
+	{Protocol: "udp", DstPort: 162, Class: ClassSNMP},
+
+	// --- Web (existing + PROTO-07) ---
+	{Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
+	{Protocol: "udp", DstPort: 443, Class: ClassQUIC}, // PROTO-07: must use "udp", NOT "tcp"
+	{Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
+
+	// --- Mail (existing SMTP + PROTO-01) ---
+	{Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
+	{Protocol: "tcp", DstPort: 143, Class: ClassIMAP},    // D-03: IMAP plain
+	{Protocol: "tcp", DstPort: 993, Class: ClassIMAP},    // D-03: IMAPS
+	{Protocol: "tcp", DstPort: 110, Class: ClassPOP3},    // D-03: POP3 plain
+	{Protocol: "tcp", DstPort: 995, Class: ClassPOP3},    // D-03: POP3S
+	{Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub}, // D-04: separate from SMTP
+
+	// --- Remote Access (existing SSH + PROTO-03) ---
+	{Protocol: "tcp", DstPort: 22, Class: ClassSSH},
+	{Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
+	{Protocol: "tcp", DstPort: 23, Class: ClassTelnet},
+	{Protocol: "tcp", DstPort: 5900, Class: ClassVNC},
+
+	// --- File Transfer (PROTO-02) ---
+	{Protocol: "tcp", DstPort: 20, Class: ClassFTP},  // D-03: FTP data
+	{Protocol: "tcp", DstPort: 21, Class: ClassFTP},  // D-03: FTP control
+	{Protocol: "tcp", DstPort: 445, Class: ClassSMB},
+	{Protocol: "udp", DstPort: 69, Class: ClassTFTP},
+
+	// --- Database (PROTO-04) ---
+	{Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
+	{Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL},
+	{Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
+	{Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB},
+
+	// --- VoIP (PROTO-06) ---
+	{Protocol: "tcp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain TCP
+	{Protocol: "tcp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS TCP
+	{Protocol: "udp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain UDP
+	{Protocol: "udp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS UDP
+
+	// --- Infrastructure extension (PROTO-08, D-01) ---
+	{Protocol: "tcp", DstPort: 389, Class: ClassLDAP},  // D-03: LDAP plain
+	{Protocol: "tcp", DstPort: 636, Class: ClassLDAP},  // D-03: LDAPS
+	{Protocol: "tcp", DstPort: 88, Class: ClassKerberos},
+	{Protocol: "udp", DstPort: 88, Class: ClassKerberos},
+	{Protocol: "udp", DstPort: 514, Class: ClassSyslog},
+
+	// Catch-alls (must be last — D-06):
 	{Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
 	{Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
 }