Anchor your domain with the _aria TXT record

[PLANNED] — applies from L1. Domain anchoring is specified in §3.4 and required from L1; L1 is not issued yet (/planned#l1-l3). Nothing on this page can be completed today; it describes what the step will be.

What the record does

_aria.<domain> is published by the agent's controller and answers one question: does this domain back this agent? It is the opposite direction from _aria-policy, which a receiver publishes to say whom it admits. Two records, two publishers, never the same one.

What it will contain

The pointer names the DID, a SHA-256 of the credential, and where the full document resolves. ML-DSA signatures are too large for DNS, so the record points; it does not carry.

v=ARIA1; did=did:aria:example.com:agent-alpha; hash=sha256:a1b2c3d4e5f6...; aid=https://example.com/.well-known/aria/agent-alpha.json

What it will not require

An L0 agent has no domain and needs no record. The policy record on the receiver side never demands anything of the agent's DNS.