The IETF meets in San Francisco from November 14 to 20. It is the last meeting before one of two DNS-based proposals for AI agent identity expires as a draft. The other became a Linux Foundation project on November 10.

On October 30, someone pulled records in bulk from an internal sales tool at WorkOS, a company that sells login and identity software. A week later WorkOS said the intruder was an AI security agent that had escaped a researcher’s test environment.

WorkOS did not find the owner. The researcher read the first notice, wrote in and took responsibility. Only then could WorkOS and an outside forensics firm match the evidence to their logs.

An agent crossed a company boundary and carried nothing that said who answered for it. That is the gap both proposals aim at.

Two Proposals

The Agent Name Service came out of GoDaddy. The Linux Foundation said in June that it intended to take the project on, and made it formal at KubeCon on November 10, with a technical steering committee and eleven named backers. Cisco, Cloudflare, DigiCert, Infoblox and Salesforce are on the list.

ANS gives an agent a structured, versioned name, something like ans://v1.0.0.my-agent.example.com. The name says what the agent does and how to reach it, as well as whose it is. Identity, verification and discovery are all in scope. It is also young. In June a Cloud Security Alliance review found that the reference implementation used mock cryptography for demonstration.

DNSid comes from Identity Digital, which spun the work out in September as a company called Known. Vint Cerf joined the effort’s advisory board in July.

The design is narrow. The owner publishes one signed TXT record at _dnsid under the agent’s name. It points to the owner’s keys, the agent’s keys, a status endpoint and a lifecycle log. No new record types. DNSSEC is recommended, not required.

The specification says DNSid does one thing, which is bind an agent to an accountable entity. Discovery and capability are left to others.

Its limit is standing. DNSid is one author’s individual Internet-Draft. No working group has adopted it, and the current version expires December 31.

Where They Overlap

The tidy version is that ANS says what an agent is and DNSid says who is on the hook. Some of that is Known’s framing. Coverage of ANS talks about ownership too.

There are also more than two. In June The New Stack counted at least four DNS-based efforts, including DNS-AID from Infoblox. Infoblox now backs ANS as well.

That article made the objection I would expect from this audience. The trust chain is old, and the loudest advocates sell names. GoDaddy is a registrar. Identity Digital is a registry.

Verisign belongs on that list too. The company that runs .com is hosting this IETF meeting, and it has a draft of its own. It is called DAN, and it proposes two new record types, AIDISCA and AIINDEX, for agent discovery. DNSid’s pitch is that it changes nothing in DNS. Verisign is asking for new record types.

I worked at Afilias, a registry, from 2015 to 2020. Registries welcome new reasons to register a name. That does not make the idea wrong. It does mean the commercial interest should be said out loud.

Not Really a Choice

Neither system holds anyone’s data. Each is a small signed record in the owner’s own zone. As far as I can tell, nothing stops an operator from publishing both, much as most publish SPF, DKIM and DMARC together.

So the contest is for the verifiers. A record is worth something only if the other side looks for it, and most enterprises will take whatever their identity vendor reads. Okta and Microsoft already ship agent IDs.

Regulation will not settle it either. No government I found names either proposal. NIST opened a voluntary agent standards effort in February. The EU’s AI Act wants traceable logs for high-risk systems and has no category for agents. China published national guidance in May under which registration providers issue each agent an identity code. That model runs through a central registrar, not the operator’s own domain.

Who Gains, Who Loses

Companies on the receiving end gain an owner to call. Legitimate operators gain a pass that gets their agents let in. Registrars, registries, DNS operators and certificate authorities gain a new reason for every record they sell.

Independent developers and researchers stand to lose. An agent with no domain behind it will look suspect. Small operators take on more to register, rotate and renew, and a lapsed domain could mean a lost agent identity.

Brand owners get a familiar problem in a new place. Bill Hartzer pointed out on launch day that whoever holds a lookalike domain can register a fully verified agent on it. Verified is not the same as trustworthy.

One more limit. A hostile agent does not present credentials. The WorkOS agent broke in, and no record would have stopped it. What the case shows is the attribution gap, not a break-in these proposals prevent.

What to watch

Whether the DNSid draft is revised or finds a working group before December 31. Whether launched ANS gets an independent security review. And whether the two sides say how they fit together, because the alternative is several ways to name the same agent.

Who answers for yours?