Glossary · Verification

Domain control verification

Updated 2026-09-23

Domain control verification answers one narrow question: can this party change what a domain publishes? The usual method is a TXT record containing a value the verifier chose. Only someone with access to the domain's DNS can add it.

In AgenID the operator's manifest names an operator_domain. Confirming control of that domain is the evidence behind the protocol's L2_DOMAIN_VERIFIED level.

Definition

Domain control verification is a check that the party making a claim can change DNS or web content for a domain, usually by publishing a challenge value in a TXT record or at a well-known URL.

Also known as: domain verification, DNS TXT challenge

How it relates to AgenID

At /verify/domain an operator publishes an _agenid TXT record and AgenID performs a real, read-only DNS lookup. The spec lists dns_txt_challenge and http_wellknown_challenge as evidence types for L2. AgenID holds no DNS provider credential and has no DNS write path.

The reference deployment at agenid.com issues nothing above L1_REGISTERED today. L2 and higher require a VerificationAssertion signed by a root authority key, and that key has not been created yet.

Confirming domain control today records evidence and raises nothing above L1.

Why it matters

Domain evidence is re-derivable: anyone can query the same DNS record. A mistaken or forged L2 would be externally detectable, which is why the published issuance policy starts with L2 and only L2 once the trust root exists. L3 evidence, by contrast, is offline documentation nobody outside can re-check.

What it does not mean

Controlling a domain does not make an operator trustworthy, and it does not grant the agent any permission. Which agent is acting is a different question from what it is allowed to do.

In the protocol model an L2 assertion also carries the manifest digest, so it would apply to one manifest version and stop applying when the manifest changes.

Frequently asked questions

Will adding the TXT record raise my agent's level?

Not today. It records evidence of domain control. Issuing L2 needs an assertion signed by the root authority key, which does not exist yet.

Can AgenID add the record for me?

No. You add it at your DNS provider. One-click setup through Domain Connect is pending provider template registration.

Is this the same as a TLS certificate check?

It is a similar idea applied to a different claim. The result is bound to one manifest version through its digest.

What agenid.com issues today

The reference deployment at agenid.com issues DECLARED and L1_REGISTERED only. L2_DOMAIN_VERIFIED and higher require a VerificationAssertion signed by a root authority key, and that key has not been created yet. L5 is reserved by the specification and is not issuable at all.

Identity is not permission

Which agent is acting and who declared it is one question. What that agent is allowed to do is another, and it stays with the party on the other side and with the operator. Protocol v1.1.1 defines no signed authorization object.

verify

Prove domain control

learn

How to verify an AI agent, step by step

glossary

Domain Connect