---
name: dns-aid
description: Publish DNS Agent Identity Directory records when using signed or identified agents.
---

# DNS AID

Use this skill when a CanAgentUse report flags `dns-aid`. The goal is to implement the exact public signal the scanner evaluates, not to perform a broad redesign. Treat the report evidence as the failing test case and make the smallest production-quality change that turns that evidence into a pass.

## What This Check Evaluates

This check looks for emerging DNS-AID agent discovery records under `_agents` using HTTPS/SVCB DNS records. It validates the standards-backed HTTPS/SVCB shape, records DNS-AID-specific routing evidence such as `alpn` and `endpoint`, and reports DNSSEC authentication evidence when visible from the resolver.

## Pass Criteria

- at least one expected `_agents` label returns a HTTPS or SVCB record
- at least one record is ServiceMode, not only AliasMode
- the ServiceMode record has parseable SVCB presentation or structured resolver data
- mandatory SvcParams are known or explicitly DNS-AID-compatible
- at least one ServiceMode record contains `alpn`
- at least one ServiceMode record contains a parseable HTTPS `endpoint`
- the endpoint does not contain credentials
- the endpoint does not point at localhost or private address literals
- authenticated-data DNSSEC evidence is visible from the resolver

## Failure And Warning Signals

**Failures usually mean:**

- the page claims DNS-AID support but no expected `_agents` HTTPS/SVCB records resolve
- records exist but cannot be parsed as usable HTTPS/SVCB records
- a ServiceMode record marks unknown parameters as mandatory
- records exist but none provide both `alpn` and a usable HTTPS endpoint route
- endpoint evidence is not an absolute URL
- endpoint evidence uses a non-HTTPS scheme
- endpoint evidence contains credentials
- endpoint evidence points at localhost or private address literals

**Warnings usually mean:**

- no DNS-AID records found and the page does not claim DNS-AID support
- only AliasMode records are visible
- DNSSEC material is visible but authenticated-data is not confirmed
- no DNSSEC authentication evidence is visible
- records use unregistered or unknown non-mandatory SvcParams
- `endpoint` is present as a DNS-AID convention even though it is not an IANA-registered SvcParamKey
- the resolver path cannot expose complete typed HTTPS/SVCB evidence and a fallback is used

## Implementation Workflow

1. Start from the failed CanAgentUse evidence: URL, status code, content type, parsed fields, and failed criterion ID.
2. Locate the route, static asset, metadata generator, schema component, server config, or API endpoint that owns that public signal.
3. Implement the missing or malformed signal with real production values. Keep it same-origin unless the check explicitly supports external URLs.
4. Validate locally with direct HTTP requests, JSON/XML parsing, schema validation, or header inspection before relying on a full rescan.
5. Re-run the scan and compare the new evidence with the original failed criterion.

## Fix The Reported Criterion

- **DNS-AID records are missing** (warning): Publish ServiceMode HTTPS or SVCB records under `_agents`, such as `_index._agents.example.com` and `_a2a._agents.example.com`, when DNS-based agent discovery is supported.
- **DNS-AID HTTPS/SVCB records are malformed** (fail): Use ServiceMode HTTPS/SVCB records with a target name and compatible SvcParams. Do not mark private or unregistered keys as mandatory unless clients can understand them.
- **DNS-AID routing parameters are missing or incomplete** (fail): Include HTTP-compatible `alpn` values and a parseable public HTTPS endpoint parameter, or update the record to match the registered DNS-AID routing convention in use.
- **DNSSEC authentication evidence is missing** (warning): Sign the discovery zone with DNSSEC and verify `_agents` records through a validating resolver that can return authenticated-data evidence.

## Implementation Pattern

- Publish machine-readable metadata at the well-known or documented discovery path.
- Include clear names, descriptions, versions, endpoint URLs, auth requirements, and capability boundaries.
- Make every advertised URL resolvable and every advertised action actually supported.
- Document dangerous, paid, authenticated, or state-changing actions explicitly.

## Validate Before Rescanning

Validate through the CanAgentUse MCP server when the agent can use MCP tools:

1. Connect to the hosted Streamable HTTP MCP endpoint:

   ```text
   https://canagentuse.com/api/mcp
   ```

   This endpoint uses MCP Streamable HTTP. Configure it in the agent's MCP client as an HTTP/streamable HTTP server.

2. For stdio-based MCP clients, install and run the npm package:

   ```bash
   npx -y @canagentuse/mcp
   ```

3. Use the MCP tools to verify the specific fix.

   - Run `scan_website` with the public production or preview URL.
   - Use `list_checks` to confirm the check id and public docs URL.
   - Use `get_fix_guidance` with `dns-aid` if the scan still reports a failure or warning.
   - Use `get_skill` with `dns-aid` to reload this skill after updates.
   - Compare the new scan evidence for `dns-aid` with the original failed criterion.

Validate through HTTP by creating and reading a hosted scan when MCP is unavailable:

```bash
SCAN_ID=$(curl -sS -X POST https://canagentuse.com/api/scans \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://YOUR-SITE.com"}' | jq -r '.scanId // .id')

curl -sS "https://canagentuse.com/api/scans/$SCAN_ID/result" | jq .
```

After deployment, re-run the same check and verify the report evidence now satisfies the pass criteria.

## Common Mistakes To Avoid

- Do not ship sample domains, placeholder names, fake dates, fake prices, fake reviews, or unsupported capabilities.
- Do not fix a scanner warning by hiding the signal; make the public evidence accurate and parseable.
- Do not change unrelated SEO, auth, security, or commerce behavior just to satisfy this one check.

## Public Check Documentation

- https://canagentuse.com/suites/2026.06.10/checks/dns-aid/1.0.0