Glossary · Keys and discovery

Domain Connect

Updated 2026-09-23

Domain Connect describes itself as an open standard that makes it easy for a user to configure DNS for a domain at a DNS provider so it works with a service at an independent service provider. It replaces point-to-point integrations with one protocol.

The core object is a template: a JSON description of every DNS record a service needs. Service providers publish templates in a public repository, and each DNS provider decides which templates to onboard.

Definition

Domain Connect is an open standard that lets a service provider ask a user's DNS provider to apply a predefined set of DNS records, described in a template, after the user signs in and consents.

How it relates to AgenID

Domain control evidence in AgenID is an _agenid TXT record, which fits the template model. The domain check detects whether a provider supports Domain Connect. The one-click path is pending provider template registration, so today the operator adds the record by hand.

Nothing is written to anyone's DNS by AgenID: there is no DNS write path, and AgenID holds no provider credential. Confirming domain control records evidence and raises nothing above L1_REGISTERED.

Why it matters

Manual DNS edits are where many operators stop. A template flow, once providers onboard it, would let an operator publish the record in a few clicks with the change visible and consented at their own provider.

What it does not mean

Domain Connect is a DNS configuration protocol, not a verification or identity standard. Applying a record through it proves only that the user could authorize a DNS change. It grants the agent no permission and does not decide what the agent is allowed to do.

Frequently asked questions

Does every DNS provider support Domain Connect?

No. The spec says a DNS provider can be selective about templates, can require a contractual relationship, or can charge for onboarding.

What are the synchronous and asynchronous flows?

In the synchronous flow the user follows a link, signs in at the DNS provider and consents, and the change applies immediately. The asynchronous flow uses OAuth so a service can apply templates later.

Can I verify my domain today without it?

Yes. Add the TXT record manually and check it at /verify/domain.

What agenid.com issues today

The reference deployment at agenid.com issues DECLARED and L1_REGISTERED only. L2_DOMAIN_VERIFIED and higher require a VerificationAssertion signed by a root authority key, and that key has not been created yet. L5 is reserved by the specification and is not issuable at all.

Identity is not permission

Which agent is acting and who declared it is one question. What that agent is allowed to do is another, and it stays with the party on the other side and with the operator. Protocol v1.1.1 defines no signed authorization object.

Sources

verify

Prove domain control

docs

Operator onboarding guide

glossary

Domain control verification

how-it-works

How it works: scenarios

Give your agent an identity

Register an agent in the browser — the signing key is generated on your device and never sent to AgenID — or resolve an existing AgenID and re-check its signature yourself.