Ashlar Blue natively supports zero-trust automated agent payment discovery per draft-x402-dns-discovery.
Queries authoritative _x402 TXT pointers and resolves manifest endpoints.
Cryptographically confirms RRSIG validation for target DNS hostnames.
Real-time DNS TXT record diagnostics, BNF syntax validation, and empirical network telemetry across the autonomous agent payment ecosystem per the open IETF specification.
What You Are Looking At: Autonomous AI agents cannot navigate the web using human search engines, login screens, or manual billing forms. Instead, agents query the global Domain Name System (DNS) directly. Under the open draft-x402-dns-discovery specification, any domain on Earth (e.g., ashlar.blue or api.sirenic.eu) publishes a cryptographically verifiable _x402 DNS TXT record at its apex or sub-domain. This record acts as a machine beacon, advertising exactly how agents can pay for API calls, what hardware security guarantees exist, and where to fetch payment manifests.
What This Radar Does in Real Time: When you enter a domain below or click a preset, your browser executes a direct, client-side DNS-over-HTTPS (DoH) query against Cloudflare (1.1.1.1) and Google Public DNS (8.8.8.8). There is zero server proxying and zero latency overhead. The linter inspects the retrieved TXT record byte-by-byte, validating normative grammar invariants: mandatory v=x402-1 versioning, secure HTTPS well-known pointers (wk=https://...), role tagging (k=facilitator | resource-server), and comma-separated blockchain network bindings (Flare Coston2, XRPL, Base).
Why DNS Over HTTP Matters: Querying /.well-known/x402 over raw HTTP exposes agents to malicious IP routing, man-in-the-middle tampering, and webserver downtime. By embedding payment discovery directly into DNS, agents inherit global anycast caching (sub-20ms lookup latency worldwide) and cryptographic origin authentication via DNSSEC (Domain Name System Security Extensions). If a domain’s DNS record is tampered with, validating resolvers refuse the record before the agent ever risks sending funds.
ashlar.blue for facilitator, or example.com for a negative test).curl test command._x402.yourdomain.com. IN TXT "v=x402-1; wk=https://api.yourdomain.com/.well-known/x402; k=facilitator"k= or net= tags in one record; conforming agents reject ambiguous records._x402.<hostname> IN TXT
"v=x402-1; wk=https://api.ashlar.blue/.well-known/x402; k=facilitator; net=coston2; scheme=exact"
Distribution of autonomous agent hosts across the largest publishing domain clusters observed in the global empirical crawl.
| Domain Ecosystem | Active Hosts | Default Role | Status |
|---|---|---|---|
| theaslangroupllc.com | 75 hosts | Resource Server | ● Active |
| lonestaroracle.xyz | 61 hosts | Resource Server | ● Active |
| klymax402.com | 43 hosts | Resource Server | ● Active |
| x402atlas.com | 41 hosts | Facilitator & RS | ● Active |
| halowerk.com | 35 hosts | Resource Server | ● Active |
| hergertsynthora.com | 18 hosts | Resource Server | ● Active |
| ashlar.blue | Attested Enclave | Facilitator (TDX) | ● Reference |
Analysis of how current autonomous agents advertise payment discovery across DNS and HTTPS Well-Known vectors.
Endpoints with legacy schema fields (e.g., version vs x402Version) easily upgraded to draft standard.
Adoption rapidly expanding following IETF working group interop sessions.
DNS TXT resolution circumvents centralized crawler bottlenecks, provides zero-trust machine resolution via recursive DNSSEC caching, and prevents vendor lock-in to single discovery registries.
Generate copy-pasteable, RFC-conformant DNS TXT records for your domain registrar or cloud DNS provider (Cloudflare, AWS Route 53, BIND).
The normative grammar defined in draft-x402-dns-discovery ↗ requires strict semicolon-delimited key-value tagging:
The wk= pointer must explicitly use the https:// scheme. Plain HTTP pointers are rejected unconditionally to prevent downgrade spoofing.
Duplicate tags inside a single TXT record are treated as malformed, preventing divergent resolution attacks across non-deterministic parser implementations.
Hosts advertising payment routes should sign their parent zones with DNSSEC. Validated resolvers pass the AD (Authenticated Data) flag to autonomous callers.