DNS-AID discovery record

What is measured

The scanner queries DNS-AID records over DNS: SVCB records (RR type 64) at the organization entry point _index._agents.<domain>, as defined by DNS-AID (draft-mozleywilliams-dnsop-dnsaid), and at _agent.<domain>, the older single-record form. It does not query the agent names an index advertises. Pass = at least one SVCB record resolves with a TargetName and at least one SvcParamKey such as well-known, alpn, port or cap. Partial = only the TXT fallback form is published, or a record exists but carries no SvcParamKeys. Fail = NXDOMAIN, or no SVCB and no TXT record at those names. Not measured = the DNS-over-HTTPS resolver answers none of the DNS-AID questions.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              DOMAIN=example.com
dig +short TYPE64 _index._agents.$DOMAIN; dig +short TYPE64 assistant.$DOMAIN
            

The fix

This is the artifact to ship. It is the complete change, not a description of one.

              ; DNS-AID records for example.com (draft-mozleywilliams-dnsop-dnsaid)

; Organization index entry point: the agents this domain advertises.
_index._agents.example.com. 3600 IN SVCB 1 agent-index.example.com (
    alpn="h2"
    port=443
    well-known=agent-card.json
)

; One SVCB record per advertised agent.
assistant.example.com. 3600 IN SVCB 1 . (
    alpn="mcp,h2"
    port=443
    ipv4hint=192.0.2.1
    ipv6hint=2001:db8::1
    well-known=agent-card.json
    cap=https://example.com/.well-known/agent-card.json
)
            

Related checks