Skip to content

DISC-017Find

DNS-AID agent discovery record published

Whether your domain publishes a DNS-AID record that tells agents where to find its agents.

What we check

We check for a DNS-AID index record: a ServiceMode SVCB record (RFC 9460) at _index._agents.<your domain>. DNS-AID is described in draft-mozleywilliams-dnsop-dnsaid-02 (2026-05-27). This is an individual Internet-Draft that no IETF working group has adopted. We do not check whether the record is DNSSEC-signed, so a PASS means the record is published, not that it is validated.

Why it matters

DNS-AID lets an agent find the agents a domain runs, for example an MCP server or an A2A agent, by looking up DNS before it contacts your website. If your shop runs such agents, the record gives a shopper's agent one more way to find them and start searching, buying or checking orders. If you run no agents, there is nothing to publish.

How we check

We ask one DNS question for an SVCB record at _index._agents.<your registrable domain>, through the resolver our scanner already uses. We never send your domain to a public DNS-over-HTTPS service. PASS: the answer is NOERROR with at least one SVCB record. A CNAME with no SVCB record behind it does not count. FAIL: the name does not exist (NXDOMAIN), or it exists but has no SVCB record. SKIPPED: the resolver did not give a usable answer (for example a timeout, SERVFAIL or REFUSED), the scan could not query DNS, or the host has no registrable domain (such as localhost or an IP address). We do not query other names that some checkers use, such as _a2a._agents or _mcp._agents, because draft -02 does not define them.

How to fix it

  1. If your shop runs agents (an MCP server, an A2A agent), publish a ServiceMode SVCB record at _index._agents.<your domain> that points to their index.
  2. Add the record at your DNS provider. Check that your provider supports the SVCB record type.
  3. Sign the zone with DNSSEC, because DNS-AID consumers are told to prefer validated answers.
  4. DNS-AID is an individual IETF draft. Re-check draft-mozleywilliams-dnsop-dnsaid before you rely on the record names.

What good looks like

; Zone file for example.com
_index._agents.example.com. 3600 IN SVCB 1 agents.example.com. alpn="h2" port=443

; Check it with:
; dig _index._agents.example.com SVCB

Sources