1 September 2026. That is the date on Verisign’s security blog that made me stop skimming and start drawing zone-file boxes on a napkin. Full disclosure: I almost treated “new DNS record types for AI” as another acronym pile. Then AIDISCA and AIINDEX clicked as two jobs with one root — your domain.. That helps.
Verisign’s DAN drafts turn a speakable owned domain into a practical endpoint for dns ai agent discovery — AIDISCA for association, AIINDEX for publication points — under DNSSEC/DANE-shaped trust.
Read the primary source on the Verisign DAN blog, keep policy backdrop on ICANN, and sanity-check market noise on NameBio. For the portable-identity half of the same September story, open our Linux Foundation ANS analysis. For naming posture when trust still wins rounds, keep the USA startup domain choice guide on the same desk.
What is DAN, and how does dns ai agent discovery actually work?
DAN is Verisign’s proposed framing for DNS record types aimed at AI-agent discovery. In plain English: instead of hoping every agent lives as a random URL in a README, operators publish structured signals in DNS so tools can find association and publication metadata under a domain you control. When I say dns ai agent discovery in this piece, I mean that job — discovery via DNS, not a new social network of bot handles.
AIDISCA is the association piece: domain ↔ agent. One job. AIINDEX is the enumeration piece: where are the publication points for agents under this name? Clean map. The trust story leans DANE-like and assumes DNSSEC hygiene. License language in the Verisign writeup points at royalty-free intent for the proposed approach. That is encouraging for implementers. It is still a draft conversation, not a checkbox in every GoDaddy panel.
Why do domains become discovery endpoints under DAN?
Because DNS already answers questions at global scale. That helps. If association and index data live as records in your zone, then the second-level name is the discovery root. Agents, brokers, and security tools can query known names instead of scraping marketing sites. That is the technical punchline: your brand’s DNS home is no longer “just the website.” It is a machine-readable front door.
My take? Founders who already own a clean zone win the boring race. Founders who rent identity on third-party platforms will glue discovery onto someone else’s namespace and regret it during diligence.
| Piece | Job | What you publish | Founder implication |
|---|---|---|---|
| AIDISCA | Associate domain ↔ agent | Association proofs / links in DNS | Own the zone you claim |
| AIINDEX | Enumerate publication points | Index of where agents are published | One coherent brand root helps |
| DNSSEC / DANE-like trust | Authenticate what clients see | Signed zone + related trust signals | Budget adult DNS, not parking DNS |
| Speakable .com / .app | Human + machine continuity | The name people say and tools query | Phone test still gates everything |
How should founders prepare a domain for dns ai agent discovery?
Prepare the root and the ops, not a fantasy record set you cannot maintain. Discovery via DNS only helps if the name is speakable, the zone is controlled, and the people who can publish records are named on a real RACI — not a Slack emoji.
- Lock one hero domain — product software often lands on .app; default USA trust still loves .com.
- Run the phone test once — discovery cannot fix a brand you spell every call.
- Move to DNSSEC-capable hosting — signed zones will matter for DANE-like stories.
- Document publish rights — who can add AIDISCA/AIINDEX-shaped records later?
- Consolidate redirects — one discovery root beats five almost-homes.
- Budget trademark screens — agent brands collide in software classes fast.
- Keep a human lander adult — machines discover; humans still diligence.
Honestly, step two still deletes more bad plans than any DNS diagram. Mouths first. Records second. Then ops.
What does royalty-free + DNSSEC change for implementers?
Royalty-free language lowers the fear that discovery records become a patent tax on every startup. DNSSEC raises the bar on operators who still run unsigned zones because “it worked for email forwarding.” If trust is DANE-like, unsigned parking DNS is not a strategy — it is a future incident report.
I am not telling every solo founder to become a DNSSEC expert tonight. I am telling you to stop choosing DNS hosts that cannot grow into signed zones when your security questionnaire asks.
How does DAN connect to Linux Foundation ANS?
ANS talks portable agent identity federated on existing DNS. DAN talks discovery record types under domains. Same tree, different branches. Read them together or you will overfit one press cycle. Identity without discovery is a lonely name. Discovery without a stable identity home is a scrape.
September 2026 is noisy because both threads hit the same week. Noise is fine. Your job is one speakable owned root that can carry both stories later.
When should a startup choose .app vs .com vs .ai for agent products?
.app fits shipping software callsigns with modern trust storytelling. .com fits unmarked USA email and partner habit. .ai fits AI-native products with clean stems — not fashion leftovers. Discovery drafts do not force .ai. They force ownership and speakability.
When I walk founders through inventory after standards news, I often point at a clean product listing like ShiftHub.app as posture — a software home that can grow into discovery endpoints without sounding like a meme. Study it once. Then decide if your product sentence matches that lane.
What mistakes will security reviewers punish first?
Unsigned zones with bold “agent discovery” claims. Shared registrar credentials. Abandoned agent subdomains that still answer. Marketing pages that assert AIDISCA support with no zone evidence. Reviewers are not impressed by acronyms. They are impressed by control.
I’ve sat on diligence calls where the engineer could not name the DNS host. That call ends badly whether or not Verisign’s draft is elegant. Fix ownership theater before you advertise discovery theater.
How should investors read DAN without inventing a new junk category?
Do not invent an “agent DNS” leftover category and mark it to five figures. Dns ai agent discovery rewards clean brandables that can host adult zones. It does not subsidize unspeakable keyword mashups. Keep your sheet in speakability buckets. Keep your ego out of the average.
Browse premium domains after the technical filter if you need product-software references. Soft CTA stays soft — teach the zone story first.
What should domain investors not do with DAN headlines?
Do not paste five-figure asks onto every leftover that contains “agent,” “bot,” or “dns.” Discovery drafts amplify clean brandables and punish invents that fail the phone test. Liquidity still lives in mouths and end-user fit. Standards are a spotlight, not a price floor for junk.
I reprice after Verisign posts the same way I reprice after ANS notes: overweight speakable .app/.com for software buyers, hold elite AI-native stems, cut costume inventory. NameBio remains a receipt desk — not a vibes desk.
What would a 90-day founder checklist look like?
Days 1–30: lock the hero name, phone-test it, fix registrar access, and write the human product page. Days 31–60: move toward DNSSEC-capable hosting and document who can edit records. Days 61–90: watch DAN/ANS drafts, refuse premature “we support DAN” marketing, and keep escrow cash ready if a better speakable root appears. That checklist is boring on purpose. Boring ships when diligence asks for receipts.
I print checklists because Slack threads evaporate. Zone files do not forgive evaporated owners.
What would I ship in the next 30 days if I ran an agent startup?
I would finalize the hero domain, enable adult DNS with a path to DNSSEC, write the association story in plain English on the site, and stop scattering identity across rented handles. I would not claim production DAN support until drafts and tooling exist that my team can operate. Credibility beats early cosplay.
And I would keep the Verisign blog bookmarked next to the ANS coverage. The people who understand dns ai agent discovery as “owned zone + speakable brand + signed DNS path” will look boring in September and correct in the next diligence cycle. Keep domain tools and the acquisition FAQ nearby when diligence suddenly cares about agent DNS. Boring is underrated.
My close: DAN is not a reason to panic-buy acronym domains. It is a reason to treat your zone file like product surface. Own the name. Say it out loud. Then let AIDISCA and AIINDEX land on a house that already feels adult.
