Evaluate DNS-based agent discovery
DNS-AID is an IETF Internet-Draft proposing discovery of agent endpoints and metadata through DNS SVCB records. It is not an approved RFC. Adoption depends on the clients and services you use; it is not a requirement for every website.
Orchestor does not support automated DNS-AID checks. A DNS-AID item in the diagnosis screen does not establish that DNS was queried. The site's publication state is unknown, and an Orchestor rescan cannot verify DNS-AID.
Discovery methods in the draft
This page refers to draft-mozleywilliams-dnsop-dnsaid-02, dated May 27, 2026 and expiring November 28, 2026. Before adoption, check the revision and the client's support.
- Find a known agent: query SVCB records at the agent's primary owner name to retrieve its endpoint information (section 3.1).
- Find agents in an organization: query SVCB at
_index._agents.<domain>for a pointer to the organization's index. The data, protocols, and schemas served by that index are outside the draft's scope (section 3.2).
An absent organization-index answer does not establish that every individual agent record is absent.
| Mechanism | What it can establish | What it does not establish on its own |
|---|---|---|
| SVCB discovery | Published endpoints and metadata | A successful connection, user permissions, or successful operations |
| Validated DNSSEC | DNS data origin and integrity | A benevolent agent or application access rights |
| DANE TLSA | TLS endpoint authentication under the approach described in the draft | Application user authentication or authorization |
The draft allows deployment without DNSSEC, but its DNS authenticity guarantees depend on a validated DNSSEC chain of trust. TLSA records require DNSSEC signing when used. Publishing DNS records does not justify removing existing OAuth, API keys, or workspace authorization (sections 1.1 and 6.1–6.4).
Before adoption
- Identify a client that actually consumes DNS-AID, its version, and the discovery methods it supports.
- Identify the existing MCP or A2A service to advertise, its endpoint, public metadata, and authentication requirements. Do not create a service just to improve a score.
- Match the primary owner, endpoint, and parameter meanings to the selected specification and client implementation. Additional SvcParamKey numbers await IANA assignment in the draft, and experimental mechanisms remain. Do not invent record names, values, or interoperability claims (sections 5 and 7.1).
- Check DNS responses and endpoint metadata separately, then verify the required authentication and actual operations. Record observed facts separately from unverified behavior.
If the client or service has not been selected, make that choice before changing DNS. This page provides no production-ready record example and does not claim that Orchestor has published DNS-AID records.