# DNS-AID Agent Discovery

Publish DNS for AI Discovery records under `_agents` so agents can discover HTTP entrypoints before fetching site metadata.

## Fix

1. Add ServiceMode SVCB/HTTPS records such as `_index._agents.example.com` and `_a2a._agents.example.com`.
2. Include `alpn` and `endpoint` service parameters for each advertised entrypoint.
3. Sign the public discovery zone with DNSSEC.

Example record shape:

```dns
_index._agents.example.com. 300 IN HTTPS 1 . alpn="h2,h3" endpoint="https://example.com/agents.json"
_a2a._agents.example.com.   300 IN HTTPS 1 . alpn="h2"    endpoint="https://example.com/.well-known/agent-card.json"
```

## Verify

```bash
dig HTTPS _index._agents.example.com
dig HTTPS _a2a._agents.example.com
dig +dnssec HTTPS _index._agents.example.com
```