AI & Domains
Your Domain Is Your Agent's Name: Identity for the Agentic Web
2026-08-13 · OSIR Team
Summary: As AI agents become a majority of web traffic, the question "who is this agent and who does it act for?" has become urgent infrastructure work. The emerging answers - IETF drafts like DNS-AID and the Agent Name Service, A2A agent cards, Cloudflare's Web Bot Auth - all anchor agent identity in the same place: the domain name system. If that holds, the domain you own becomes the name your agent carries. This post maps the landscape, including the migration trap we walked into with our own agent card.
Part 4 of our Agents & Domains miniseries. Previously: can an AI buy you a domain?
The web is closing to anonymous agents
Two numbers set the scene. In June 2026, Cloudflare reported that bots generate 57.5% of HTML web traffic - overtaking humans for the first time, driven largely by AI assistants browsing on people's behalf. And the reaction is already policy: Cloudflare blocks AI crawlers by default for new sites, extends default-blocking further in September 2026, and has replaced free crawling with paid-use models for publisher content.
So an agent that cannot prove who it is increasingly gets a closed door. Identity is becoming the price of admission - and every serious proposal for agent identity resolves to a domain.
The proposals, and where each one anchors identity
| Proposal | Backers | How identity works | Status (August 2026) |
|---|---|---|---|
| DNS-AID | Infoblox | Agents published in DNS via service discovery, secured with DNSSEC | IETF individual draft |
| Agent Name Service (ANS) | GoDaddy co-authors | Agent naming and verification via DNS + certificates, using domains operators already own | IETF individual draft; Infoblox + GoDaddy joint endorsement May 2026 |
| A2A agent cards | Linux Foundation, 150+ orgs | A JSON card at a well-known URL on your domain describes the agent and its skills | v1.0 stable, signed cards; adoption still early |
| Web Bot Auth / Signed Agents | Cloudflare; IETF WG chartered | Agents sign requests cryptographically; verifiers check published keys | Deployed in production ahead of standardization |
| MIT Project NANDA | MIT | A federated index for agent registries, described as "DNS for agents" | Research + fresh IETF draft (July 2026) |
| ERC-8004 | Ethereum community | On-chain identity and reputation registries for agents | Ethereum mainnet since January 2026; draft EIP |
Six different efforts, and the name at the center of every one is a domain - the only durable, ownable, globally-resolvable identifier anyone actually has. Even the on-chain approach connects back - the .kred registry anchors its agent reputation system (Score.Kred, built on ERC-8004) to domain tokens, which we covered in our .kred guide.
None of these is a finished standard. All of them are individual drafts, early specs, or pre-standard deployments. But when the registrar industry's heavyweights (GoDaddy, Infoblox), the CDN layer (Cloudflare), the Linux Foundation, and MIT independently converge on domain-anchored agent identity, the direction is hard to miss.
The agent card reality check - including ours
The A2A protocol is the furthest along on paper: a stable 1.0 spec, signed agent cards, over 150 supporting organizations, integrations in the big cloud agent platforms. The practice is humbler. A survey in late July 2026 found only about 65 published agent cards on the entire public web - and 15 of those sit at a location where a current A2A client will never find them.
Here is the trap: early versions of the spec put the card at /.well-known/agent.json. Since spec 0.3.0, the standard location is /.well-known/agent-card.json. Cards that never moved are invisible to 1.0-era clients.
We would love to smugly explain other people's migration mistakes, but while writing this post we checked our own A2A card - published back when the old path was the spec - and found it exactly where we left it: at the legacy path, with the new path not yet answering. We are in that survey's unlucky 15. The fix (serving the card at both paths) is in flight on our backend, and the lesson generalizes: in a standards land rush, publishing early is an advantage that decays unless you keep tracking the spec. Our live card, for the curious, describes 7 agents with 53 skills; the AI integration docs cover how to call them.
What this means if you own a domain (or several)
What to do about it, starting with the safest call:
- Your domain is the safest bet in the room. Every proposal builds on names you can already own. An agent identity like
agent.yourcompany.comcosts nothing beyond the domain you have and works with today's drafts (subdomains, TXT records, well-known URLs) the moment any of them settles. - Don't buy speculative "agent TLDs." Alternative-root extensions marketed for AI agents are not real, resolvable TLDs. Real candidates (like the .agent string proposed for ICANN's 2026 round, which we covered in the new-extensions post) are years from launch if they survive contention. A domain you own today beats a string that may never exist.
- Verification is coming; be verifiable. Signed requests and DNS-anchored discovery both reward domains with clean DNS hygiene: DNSSEC enabled, records tidy, control demonstrable. Every OSIR domain includes DNSSEC support - and yes, your agent can manage those records itself.
- Expect your registrar to speak agent. Discovery documents, agent cards, and signing keys live at the registrar/DNS layer, so this becomes registrar work. It is why we ship the MCP connector, the A2A card, and agent-facing docs as products rather than experiments.
Agent identity FAQ
Does my AI agent legally need a domain?
No - nothing requires it today. But every emerging discovery and verification mechanism (DNS-AID, ANS, A2A cards, Web Bot Auth key discovery) is built around domains, so an agent meant to be found or trusted by others will in practice be named by one.
What is an A2A agent card?
A JSON document at a well-known URL on your domain (since A2A spec 0.3.0: /.well-known/agent-card.json) describing an agent's identity, endpoints, and skills so other agents can discover and call it. A2A 1.0 adds cryptographic signing. If you published a card before mid-2025, check the path - the location changed, and clients only look at the new one.
Should I create a subdomain for my agent?
It is the sensible pattern: something like agent.yourdomain.com gives the agent a stable name, its own DNS records, and TLS - without touching your main site. Any OSIR domain can add it in seconds (an A or CNAME record), and part 5 of this series walks through the full setup.
What is Web Bot Auth?
A mechanism (Cloudflare-led, now with an IETF working group) where agents cryptographically sign their requests and sites verify the signature against published keys. It is already enforced in production by major infrastructure providers ahead of formal standardization - a signal of how fast "prove who your agent is" is becoming mandatory.
Do I need blockchain for agent identity?
No. DNS-based approaches cover discovery and verification without any chain. On-chain systems like ERC-8004 add portable reputation on top; the .kred registry bridges both worlds by anchoring on-chain agent identity to a domain.
Part 4 of the Agents & Domains miniseries. Next: Give your agent a home. Previously: Can an AI buy you a domain?
Image generated with AI (Higgsfield).