ARIA1.0
English only · Spanish [PLANNED]

Publish your admission policy

Task: tell agents what your service admits, before they knock, with one DNS record. This is the one part of the protocol a third party can deploy today without asking anyone. The narrative is at /protocol; the grammar and every parameter are normative in §8. This page is the DNS-panel walk.

1 · Decide the host

The record lives at _aria-policy.<host>, where <host> is the name that serves your API. Agents look it up on the host first, then on the apex. Publishing on the apex covers every host under it; publishing on a host overrides the apex for that host only.

2 · Add the record

In your DNS provider's panel, create a TXT record:

  • Type: TXT
  • Name: _aria-policy (under the host or the apex)
  • Value: the policy string, quoted
  • TTL: your usual; 300–3600 s

Start with this exact value. It admits every valid credential and blocks nothing.

DNS · your own zone · start with enforce=monitor
_aria-policy.yourdomain.com  TXT  "v=ATP1; min=L0; enforce=monitor; rua=mailto:you@yourdomain.com"

v=ATP1 must come first; enforce= is mandatory. Unknown parameters are ignored unless written !name=.

3 · Self-check

dig · runs against your own zone once the record propagates
dig +short TXT _aria-policy.yourdomain.com

You should see your policy string back, in quotes. If you see nothing, wait for propagation or check the name: _aria-policy, one underscore, one hyphen.

4 · Read the reports, then tighten

rua= names where aggregate reports go. Watch who arrives for a week. Then, in order:

  1. enforce=warn — agents are still admitted, non-compliant ones are marked so your API can treat them differently.
  2. enforce=strict — non-compliant agents are refused with a result code and a literal reason.

Raise min= only when you understand your traffic, and remember that today every issued credential is L0: min=L1 admits nobody yet.

5 · Configure the same policy in your evaluator

The DNS record informs; the policy your evaluator enforces decides. They must match. Publishing a stricter record than you enforce misleads agents; enforcing stricter than you publish surprises them.

The receiver side of this — admitting an agent against the policy — needs the holder proof, which is in deployment. Publishing the record is fully useful today: it is how agents learn your requirements, and how you start collecting reports.