DNS-AID proposes DNS trust controls for AI agents

DNS-AID is a proposal to use the Domain Name System, or DNS, as a trust and control layer for autonomous AI agents. These agents are software systems that can select tools, access services and delegate work to other agents, often without a person directing every step. The proposal addresses a basic security question: how can an agent find the intended website, data source, cloud workload or other agent without being redirected to an unauthorized destination?

The work arrives amid a broader dispute over whether frontier AI development should slow down. On September 12, 2026, Anthropic’s CEO published an essay calling for slower improvement of AI model capabilities. The CEOs of OpenAI and xAI publicly agreed. In July, about 1,400 employees at leading AI companies had asked the US government to support an international effort to create technical and governance tools for deliberately pacing advanced AI development. Critics of that position suggested pacing could reduce competitive pressure, answer shortages of computing capacity or shape perceptions before possible initial public offerings. Others raised antitrust and self-interest concerns.

Infoblox argues that organizations should not wait for that debate or for new regulation before improving the safety of systems they already deploy. It compares the task with fire safety, where doors, walls, alarms, sprinklers, hydrants, building codes, inspectors, emergency services, public education, drills and insurance combine to reduce risk. Applied to AI, the argument is that manufacturing, health care, law, security, education and frontline operations each need controls suited to their own work.

The company proposed DNS for AI Discovery, known as DNS-AID, as an open standard that is advancing as an Internet Engineering Task Force draft. It is also part of the IETF’s Discovery of Agents With Names, or DAWN, effort, which is examining secure ways to discover AI agents and other entities connected to networks across organizational boundaries. DNS-AID has also been launched as a Linux Foundation open-source project with support listed from Akamai, Cloudflare, CSC, Equinix, GoDaddy, IDC, Indeed, Internet Systems Consortium and WWT. GoDaddy and Infoblox say DNS-AID and Agent Name Service are intended to work together.

Infoblox has additionally submitted comments to the US National Institute of Standards and Technology on its Concept Paper on Identity and Authority of Software Agents, its request for information about AI-agent security and its Cyber AI Profile. The company also responded to consultations concerning the revision of the EU Cybersecurity Act and Singapore’s draft addendum on securing agentic AI systems. It most recently supported a House bill directing NIST to develop a security framework for AI agent discovery.

DNS has translated names such as infoblox.com into numerical Internet Protocol addresses such as 151.101.2.253 for more than 40 years. It is federated, meaning no single organization operates the entire system, and it is already deployed globally. Domain Name System Security Extensions (DNSSEC) add cryptographic verification, allowing a resolver to check that signed DNS records are authentic and have not been altered or substituted.

DNS-AID would give an AI agent a name beneath a domain controlled by its operator. In the proposal’s example, an agent at billing.acme.com could be tied through DNSSEC to the organization controlling acme.com. The DNS records could also publish the agent’s supported protocols, including A2A, its capabilities and other metadata, meaning descriptive information about the service. Infoblox presents this domain-based identity as a foundation for accountability and an agent chain of trust. It says other identity and authentication standards, including SPIFFE, Agent Name Services and ARD, also use domain names as a foundational trust root. DNSSEC authenticates DNS data, however, rather than proving that an agent’s behavior or output is safe.

The second part of the approach is protective DNS, a service that applies rules when devices request domain names. Security teams already use such controls to prevent access to known malicious or unauthorized domains. If an agent is compromised or not approved, an organization can stop users, devices and workloads from resolving its domain, cutting off the DNS-based route to that endpoint before the first connection. Infoblox describes this as a DNS kill switch because DNS becomes a control point for whether the agent can be reached.

The two controls work in opposite directions. DNS-AID is the positive control: it names an agent, links it to an operator-controlled domain and uses DNSSEC to verify the origin of its endpoint records. Protective DNS is the negative control: it blocks lookups for domains that policy or threat intelligence identifies as unauthorized or malicious. Neither mechanism can ensure that an AI model produces harmless output, but the network controls can make access decisions before an agent connects.

Domain names also sit within existing dispute and takedown processes. The Uniform Domain-Name Dispute-Resolution Policy (UDRP), administered through bodies including WIPO, allows rights holders to challenge abusive registrations and seek transfer or cancellation. The Uniform Rapid Suspension system (URS) provides a faster route to suspend domains in clear cases of cybersquatting or impersonation. Registrars and hosting providers can also be asked to dismantle abusive infrastructure. Infoblox says its Digital Risk Protection Services notify relevant parties within four minutes and achieve domain takedown in approximately nine hours, with a 98.9 percent success rate. Those figures are the company’s own stated performance metrics.

For organizations adopting agents, the practical steps are to publish each agent beneath an enterprise-controlled domain, enable DNSSEC for the relevant records, and configure DNS policies to detect, record and isolate unapproved connections. Infoblox also recommends supporting open, federated standards so organizations retain control of their agent namespaces, and participating in community testing of interoperable controls. Because DNS-AID remains an advancing draft and open-source project, it should be treated as a developing proposal rather than a universally deployed standard.

For readers assessing the privacy and security of their everyday DNS traffic, AEU DNS provides private, secure DNS for everyone, although that service is separate from the enterprise AI-agent discovery framework discussed here. The immediate lesson for IT teams is that agent deployment needs both a verifiable naming plan and a way to deny unwanted destinations, not merely confidence in the underlying AI model.