# DNS-AID

> Publish and discover AI agents through DNS instead of a central registry

- Category: Agents & Automation / Multi-Agent Systems
- Language: Python
- Licence: Apache-2.0
- Repository: https://github.com/dns-aid/dns-aid-core
- Website: https://dns-aid.org
- Canonical page: https://ai-tldr.dev/tools/dns-aid/
- Updated: 2026-05-27

## In short

DNS-AID is Publish and discover AI agents through DNS instead of a central registry. This repository is the reference implementation; the specification itself is developed at the IETF as draft-mozleywilliams-dnsop-dnsaid, and the draft — not this code — is authoritative on protocol behaviour. It sits in the Multi-Agent Systems category of the Agents & Automation tools and is open-source, written in Python and licensed Apache-2.0.

## Overview

DNS-AID — DNS-based Agent Identification and Discovery — lets AI agents find each other through the internet's existing naming infrastructure rather than a centralised registry or a hardcoded URL. You publish an agent's name, protocol, endpoint and capabilities as DNS records under a domain you already control, and any caller that knows the domain can resolve the agents it hosts. This repository is the reference implementation; the specification itself is developed at the IETF as draft-mozleywilliams-dnsop-dnsaid, and the draft — not this code — is authoritative on protocol behaviour.

The library ships as a Python SDK, a CLI and an MCP server, installed from PyPI with the extras you need. Publishing is one `dns_aid.publish()` call against whichever DNS backend you use — Route 53, Cloudflare, NS1, Cloud DNS, Infoblox, Akamai Edge DNS or dynamic DNS each have an install extra. Discovery has two paths: the DNS substrate itself, or an HTTP index for richer metadata, which also auto-detects and dereferences Agentic Resource Discovery (ARD) `ai-catalog` pointers. Results can be filtered in-process by capability, auth type, realm and signature requirements, and `dns_aid.verify()` returns a security score for an agent's records.

The project treats DNS as a trust substrate and everything above it as optional convenience. The library works standalone against any DNS provider with no dependency on a particular directory, indexer or telemetry backend; a search, indexing or telemetry layer is just an HTTP endpoint you point the SDK at, and operators are encouraged to run their own. Trust controls are opt-in and off by default, with SDK, CLI and MCP parity: per-record JWS or a DNSSEC-validated pointer for off-domain catalogs, `require_dnssec`/`min_dnssec` to enforce the resolver's AD flag on DNS-plane agents, and DANE/TLSA verification binding an agent's TLS certificate to its record.

## What it does

- Publish an agent's name, protocol, endpoint and capabilities to DNS from Python or the CLI
- Discover agents by domain over the DNS substrate, or via an HTTP index for richer metadata
- Interoperates with Agentic Resource Discovery: auto-detects and dereferences ARD ai-catalog pointers
- Pluggable DNS backends — Route 53, Cloudflare, NS1, Cloud DNS, Infoblox, Akamai Edge DNS and dynamic DNS
- Filtered discovery by capability, auth type, realm and signature algorithm, plus a `verify()` call that scores an agent's records
- Opt-in DNSSEC, DANE/TLSA and JWS trust controls with matching SDK, CLI and MCP surfaces
- Ships an MCP server so an agent can perform discovery itself

## Getting started

Install from PyPI with the extras you want; backend-specific extras are listed in the getting-started guide. Python 3.11, 3.12 and 3.13 are supported.

1. Install

   The cli and mcp extras add the command-line tool and the MCP server. Add a backend extra (route53, cloudflare, ns1, cloud_dns, infoblox, akamai-edgedns, ddns) for the DNS provider you publish to.

```bash
pip install "dns-aid[cli,mcp]"
```

2. Publish an agent

   One call writes the agent's record under your domain.

```python
import dns_aid

await dns_aid.publish(
    name="my-agent",
    domain="example.com",
    protocol="mcp",
    endpoint="agent.example.com",
    capabilities=["chat", "code-review"]
)
```

3. Discover agents at a domain

   The DNS substrate is the default path; use_http_index=True adds richer metadata and dereferences ARD catalogs.

```python
agents = await dns_aid.discover("example.com")
for agent in agents:
    print(f"{agent.name}: {agent.endpoint_url}")

agents = await dns_aid.discover("example.com", use_http_index=True)
```

4. Filter and verify

   Filters are pure-Python predicates over the in-memory result; verify() reports how well an agent's records are secured.

```python
result = await dns_aid.discover(
    "example.com",
    capabilities=["payment-processing"],
    auth_type="oauth2",
    require_signed=True,
)

result = await dns_aid.verify("my-agent.example.com")
print(f"Security Score: {result.security_score}/100")
```

## When to use it

- Make your organisation's agents findable at your own domain without registering them anywhere
- Let an agent resolve the services it needs at runtime instead of shipping hardcoded endpoint URLs
- Bind agent discovery to DNSSEC and DANE so a caller can check what it resolved before trusting it
- Interoperate with ARD catalogs and third-party agent directories without committing to any one of them

## Version history

- 2026-05-27: The Linux Foundation launched DNS-AID as a project for decentralized agent discovery, building on this reference implementation (Python SDK, CLI and MCP server) initially developed by Infoblox; initial project members include Cloudflare, CSC, Equinix, GoDaddy, IDC, Indeed, Infoblox, Internet Systems Consortium and WWT.