x402 DNS Discovery & MCP Integration

Ashlar Blue natively supports zero-trust automated agent payment discovery per draft-x402-dns-discovery.

• resolve_x402_domain

Queries authoritative _x402 TXT pointers and resolves manifest endpoints.

• verify_dnssec_chain

Cryptographically confirms RRSIG validation for target DNS hostnames.

IETF DRAFT-X402-DNS-DISCOVERY · LIVE SPECIFICATION RADAR

x402 DNS Discovery Radar & Domain Linter

Real-time DNS TXT record diagnostics, BNF syntax validation, and empirical network telemetry across the autonomous agent payment ecosystem per the open IETF specification.

RESOLVER: CLOUDFLARE + GOOGLE DOH
SPEC VERSION: x402-1
IETF DATATRACKER SPECIFICATION
HOW AGENT DNS DISCOVERY WORKS · OPERATIONAL FIELD GUIDE

What You Are Looking At: Autonomous AI agents cannot navigate the web using human search engines, login screens, or manual billing forms. Instead, agents query the global Domain Name System (DNS) directly. Under the open draft-x402-dns-discovery specification, any domain on Earth (e.g., ashlar.blue or api.sirenic.eu) publishes a cryptographically verifiable _x402 DNS TXT record at its apex or sub-domain. This record acts as a machine beacon, advertising exactly how agents can pay for API calls, what hardware security guarantees exist, and where to fetch payment manifests.

What This Radar Does in Real Time: When you enter a domain below or click a preset, your browser executes a direct, client-side DNS-over-HTTPS (DoH) query against Cloudflare (1.1.1.1) and Google Public DNS (8.8.8.8). There is zero server proxying and zero latency overhead. The linter inspects the retrieved TXT record byte-by-byte, validating normative grammar invariants: mandatory v=x402-1 versioning, secure HTTPS well-known pointers (wk=https://...), role tagging (k=facilitator | resource-server), and comma-separated blockchain network bindings (Flare Coston2, XRPL, Base).

Why DNS Over HTTP Matters: Querying /.well-known/x402 over raw HTTP exposes agents to malicious IP routing, man-in-the-middle tampering, and webserver downtime. By embedding payment discovery directly into DNS, agents inherit global anycast caching (sub-20ms lookup latency worldwide) and cryptographic origin authentication via DNSSEC (Domain Name System Security Extensions). If a domain’s DNS record is tampered with, validating resolvers refuse the record before the agent ever risks sending funds.

⚡ How to Test & Lint Any Domain
  1. Click any Quick Preset below (e.g. ashlar.blue for facilitator, or example.com for a negative test).
  2. Or type your company's own domain into the search box and click "Inspect Domain".
  3. Review the Conformance Grade, parsed tags (version, role, networks), and copy the generated curl test command.
💡 DNS Operations Pro Tips
  • Record Format: _x402.yourdomain.com. IN TXT "v=x402-1; wk=https://api.yourdomain.com/.well-known/x402; k=facilitator"
  • Reject Duplicate Keys: Never put two k= or net= tags in one record; conforming agents reject ambiguous records.
  • Enable DNSSEC: Always sign your DNS zone with DNSSEC to earn the institutional GRADE A+ badge.
LIVE DNS INSPECTION TERMINAL

Test Domain Conformance

Target RR: _x402.<hostname> IN TXT
Quick Presets:
QUERY: _x402.ashlar.blue
Fully Conformant Endpoint
98ms
GRADE A+ CONFORMANT
Protocol Version (v)
x402-1
Well-Known Manifest (wk)
-
Discovery Role (k)
-
Settlement Networks (net)
-
Payment Schemes (scheme)
-
DNSSEC Security Chain
-
Authoritative TXT Payload TTL: 3600
"v=x402-1; wk=https://api.ashlar.blue/.well-known/x402; k=facilitator; net=coston2; scheme=exact"
Probed Catalog Listings
15,216
Total endpoints observed in census
Distinct Autonomous Hosts
1,615
Unique payment-enabled hostnames
Domain Namespaces
522
Registered organizational domains
Active Manifest Publishers
911
Dual-path & well-known endpoints
🏛️ Top x402 Publishing Ecosystems
EMPIRICAL CENSUS

Distribution of autonomous agent hosts across the largest publishing domain clusters observed in the global empirical crawl.

Domain Ecosystem Active Hosts Default Role Status
theaslangroupllc.com 75 hosts Resource Server ● Active
lonestaroracle.xyz 61 hosts Resource Server ● Active
klymax402.com 43 hosts Resource Server ● Active
x402atlas.com 41 hosts Facilitator & RS ● Active
halowerk.com 35 hosts Resource Server ● Active
hergertsynthora.com 18 hosts Resource Server ● Active
ashlar.blue Attested Enclave Facilitator (TDX) ● Reference
📊 Discovery Vector Distribution
NETWORK BREAKDOWN

Analysis of how current autonomous agents advertise payment discovery across DNS and HTTPS Well-Known vectors.

HTTPS Manifest Published (/.well-known/x402) 911 Hosts (56.4%)
Syntax Conformance: One-Edit-Away 427 Hosts (26.4%)

Endpoints with legacy schema fields (e.g., version vs x402Version) easily upgraded to draft standard.

DNS TXT Pointer Adherence (_x402 RR) Accelerating (IETF Standardizing)

Adoption rapidly expanding following IETF working group interop sessions.

Why DNS TXT Discovery?

DNS TXT resolution circumvents centralized crawler bottlenecks, provides zero-trust machine resolution via recursive DNSSEC caching, and prevents vendor lock-in to single discovery registries.

⚙️ x402 DNS Zone Record Generator
DEV-OPS UTILITY

Generate copy-pasteable, RFC-conformant DNS TXT records for your domain registrar or cloud DNS provider (Cloudflare, AWS Route 53, BIND).

BIND / Standard RFC 1035 Zone Record
; x402 DNS Discovery Record _x402.api.example.com. 3600 IN TXT "v=x402-1; wk=https://api.example.com/.well-known/x402; k=resource-server; net=coston2,flare,base"
Cloudflare / Route 53 Dashboard Values
Type: TXT Name: _x402.api Content: "v=x402-1; wk=https://api.example.com/.well-known/x402; k=resource-server; net=coston2,flare,base" TTL: Auto / 3600
📜 Specification Grammar & BNF Reference
IETF STANDARDS

The normative grammar defined in draft-x402-dns-discovery ↗ requires strict semicolon-delimited key-value tagging:

x402-record = "v=" version ";" [ " " ] wk-tag *( ";" [ " " ] opt-tag ) [ ";" ] version = "x402-1" wk-tag = "wk=" https-uri opt-tag = kind-tag / net-tag / scheme-tag kind-tag = "k=" ( "facilitator" / "resource-server" / "both" ) net-tag = "net=" network-id *( "," network-id ) scheme-tag = "scheme=" scheme-id *( "," scheme-id )
Hard Invariant: HTTPS Only

The wk= pointer must explicitly use the https:// scheme. Plain HTTP pointers are rejected unconditionally to prevent downgrade spoofing.

Duplicate Key Rejection

Duplicate tags inside a single TXT record are treated as malformed, preventing divergent resolution attacks across non-deterministic parser implementations.

DNSSEC Recommended

Hosts advertising payment routes should sign their parent zones with DNSSEC. Validated resolvers pass the AD (Authenticated Data) flag to autonomous callers.