Network Working Group B. Morrison Internet-Draft Alter Meridian Pty Ltd Intended status: Informational 22 July 2026 Expires: 23 January 2027 Discovery of Model Context Protocol Servers via DNS TXT Records draft-morrison-mcp-dns-discovery-05 Abstract This document defines a DNS-based mechanism for discovering Model Context Protocol (MCP) servers, the identity of the organisations that operate them, and a cryptographic identity envelope bound to an individual Sovereign-tier ~handle published under the same zone. Three TXT records are defined. _mcp. advertises an MCP server's endpoint URL, agent protocol family, transport binding, cryptographic identity, and capability profile. _org-alter. advertises the operator's canonical organisational identity, including its legal entity, registry identifier, regions of operation, and any regulatory framework under which it must refuse external automated access. _alter. publishes an Ed25519-signed envelope binding a ~handle to a public key, an IdentityLog root reference, and a revocation commitment. DNSSEC validation is REQUIRED for the envelope record, and a DANE TLSA pin on the MCP endpoint is REQUIRED where resolving an envelope and opening an MCP session are one recognition transaction. This revision (v05) corrects earlier ones and introduces no new mechanism. It withdraws several claims that v04 could not support, marks publication of a per-individual envelope in DNS as NOT RECOMMENDED on enumeration, size, and erasure grounds, and separates the agent protocol family from the transport binding in the _mcp record, aligning that vocabulary with neighbouring DNS agent- discovery drafts. All three record formats and all three procedures are given here in full, so no earlier revision need be fetched. The mechanism complements HTTPS-based discovery, and follows the precedent set by DKIM, SPF, DMARC, and MTA-STS. Provisional registration of a companion alter: URI scheme is requested of IANA, and is not yet granted. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Morrison Expires 23 January 2027 [Page 1] Internet-Draft MCP DNS Discovery July 2026 Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 23 January 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 6 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6 3. Related Work . . . . . . . . . . . . . . . . . . . . . . . . 7 4. Why TXT rather than SVCB . . . . . . . . . . . . . . . . . . 11 5. Record Format: _mcp. (Service Discovery) . . . . . . 11 5.1. DNS Location . . . . . . . . . . . . . . . . . . . . . . 11 5.2. ABNF Grammar . . . . . . . . . . . . . . . . . . . . . . 12 5.3. Field Definitions . . . . . . . . . . . . . . . . . . . . 13 5.3.1. v (REQUIRED) . . . . . . . . . . . . . . . . . . . . 13 5.3.2. url (REQUIRED) . . . . . . . . . . . . . . . . . . . 13 5.3.3. proto (OPTIONAL) . . . . . . . . . . . . . . . . . . 14 5.3.4. transport (OPTIONAL) . . . . . . . . . . . . . . . . 14 5.3.5. Reading a record published before this revision . . . 15 5.3.6. pk (OPTIONAL) . . . . . . . . . . . . . . . . . . . . 17 5.3.7. epoch (OPTIONAL) . . . . . . . . . . . . . . . . . . 17 5.3.8. cap (OPTIONAL) . . . . . . . . . . . . . . . . . . . 18 5.3.9. attest (OPTIONAL) . . . . . . . . . . . . . . . . . . 18 5.3.10. scope (OPTIONAL) . . . . . . . . . . . . . . . . . . 18 5.3.11. priority (OPTIONAL) . . . . . . . . . . . . . . . . . 19 5.3.12. ttl (OPTIONAL) . . . . . . . . . . . . . . . . . . . 19 5.3.13. ext (OPTIONAL) . . . . . . . . . . . . . . . . . . . 19 5.4. Forward Compatibility . . . . . . . . . . . . . . . . . . 19 Morrison Expires 23 January 2027 [Page 2] Internet-Draft MCP DNS Discovery July 2026 5.5. Multi-String Concatenation . . . . . . . . . . . . . . . 20 6. Record Format: _org-alter. (Identity Bootstrap) . . . 20 6.1. DNS Location . . . . . . . . . . . . . . . . . . . . . . 20 6.2. ABNF Grammar . . . . . . . . . . . . . . . . . . . . . . 21 6.3. Field Definitions . . . . . . . . . . . . . . . . . . . . 23 6.3.1. v (REQUIRED) . . . . . . . . . . . . . . . . . . . . 23 6.3.2. org (REQUIRED) . . . . . . . . . . . . . . . . . . . 23 6.3.3. entity-type (OPTIONAL) . . . . . . . . . . . . . . . 24 6.3.4. founded (OPTIONAL) . . . . . . . . . . . . . . . . . 24 6.3.5. regions (OPTIONAL) . . . . . . . . . . . . . . . . . 24 6.3.6. bootstrap (OPTIONAL) . . . . . . . . . . . . . . . . 26 6.3.7. mcp-policy (OPTIONAL) . . . . . . . . . . . . . . . . 26 6.3.8. epoch (OPTIONAL) . . . . . . . . . . . . . . . . . . 26 6.3.9. pk (OPTIONAL) . . . . . . . . . . . . . . . . . . . . 27 6.3.10. attest (OPTIONAL) . . . . . . . . . . . . . . . . . . 27 6.3.11. ext (OPTIONAL) . . . . . . . . . . . . . . . . . . . 27 6.4. Forward Compatibility . . . . . . . . . . . . . . . . . . 27 7. Record Format: _alter. (Envelope Publication) . . . . 27 7.1. DNS Location . . . . . . . . . . . . . . . . . . . . . . 27 7.1.1. Applicability of the Envelope Record . . . . . . . . 28 7.2. ABNF Grammar . . . . . . . . . . . . . . . . . . . . . . 29 7.3. Field Definitions . . . . . . . . . . . . . . . . . . . . 31 7.3.1. v (REQUIRED) . . . . . . . . . . . . . . . . . . . . 31 7.3.2. h (REQUIRED) . . . . . . . . . . . . . . . . . . . . 31 7.3.3. pk (REQUIRED) . . . . . . . . . . . . . . . . . . . . 31 7.3.4. ilr (REQUIRED) . . . . . . . . . . . . . . . . . . . 32 7.3.5. ts (REQUIRED) . . . . . . . . . . . . . . . . . . . . 32 7.3.6. rev (REQUIRED) . . . . . . . . . . . . . . . . . . . 32 7.3.7. sig (REQUIRED) . . . . . . . . . . . . . . . . . . . 33 7.3.8. Unknown fields . . . . . . . . . . . . . . . . . . . 33 7.4. Canonical Serialisation . . . . . . . . . . . . . . . . . 33 7.5. Forward Compatibility . . . . . . . . . . . . . . . . . . 34 7.6. Multi-String Reassembly . . . . . . . . . . . . . . . . . 35 8. DNSSEC Requirement . . . . . . . . . . . . . . . . . . . . . 35 9. DANE TLSA Pin . . . . . . . . . . . . . . . . . . . . . . . . 35 10. IdentityLog Cross-Reference . . . . . . . . . . . . . . . . . 36 11. alter: URI Scheme Cross-Reference . . . . . . . . . . . . . . 37 12. Discovery and Bootstrap Procedures . . . . . . . . . . . . . 38 12.1. Discovery Procedure: _mcp. . . . . . . . . . . . 38 12.1.1. Input . . . . . . . . . . . . . . . . . . . . . . . 38 12.1.2. Algorithm . . . . . . . . . . . . . . . . . . . . . 38 12.2. Identity Bootstrap Procedure: _org-alter. . . . 40 12.2.1. Input . . . . . . . . . . . . . . . . . . . . . . . 40 12.2.2. Algorithm . . . . . . . . . . . . . . . . . . . . . 40 12.2.3. First-Run Cold Start . . . . . . . . . . . . . . . . 41 12.3. Envelope Recognition Procedure: _alter. . . . . 42 13. Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 14. Security Considerations . . . . . . . . . . . . . . . . . . . 45 Morrison Expires 23 January 2027 [Page 3] Internet-Draft MCP DNS Discovery July 2026 14.1. DNSSEC Downgrade . . . . . . . . . . . . . . . . . . . . 45 14.2. TLSA Pin Rotation . . . . . . . . . . . . . . . . . . . 45 14.3. Envelope Substitution . . . . . . . . . . . . . . . . . 45 14.4. Revocation Opacity . . . . . . . . . . . . . . . . . . . 46 14.5. Clock Skew and ts= . . . . . . . . . . . . . . . . . . . 46 14.6. Cross-Record Key Consistency . . . . . . . . . . . . . . 46 14.7. Passive-Stream Coupling . . . . . . . . . . . . . . . . 47 15. Privacy Considerations . . . . . . . . . . . . . . . . . . . 48 15.1. Public Handle Disclosure . . . . . . . . . . . . . . . . 48 15.2. DNS Query Metadata . . . . . . . . . . . . . . . . . . . 48 15.3. Revocation Unlinkability . . . . . . . . . . . . . . . . 48 16. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 49 16.1. Underscored DNS Node Name Registration . . . . . . . . . 49 16.2. alter: URI Scheme Registration . . . . . . . . . . . . . 49 16.3. Envelope Version Registry . . . . . . . . . . . . . . . 49 16.4. Org-Alter Version Registry (unchanged from v02) . . . . 50 16.5. Registry Namespace Registry (unchanged from v02) . . . . 50 16.6. Framework Token Registry (unchanged from v02) . . . . . 50 16.7. Signature Algorithm Registry . . . . . . . . . . . . . . 50 17. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 50 17.1. Minimal Envelope for a Single Handle (NOT RECOMMENDED) . . . . . . . . . . . . . . . . . . . . . . 50 17.2. Zone Hosting Multiple Handles (a publisher MUST NOT do this) . . . . . . . . . . . . . . . . . . . . . . . . . 51 17.3. Full Zone (All Three Records; the _alter record is NOT RECOMMENDED) . . . . . . . . . . . . . . . . . . . . . . 51 17.4. Instrument-Tier Handle (NOT RECOMMENDED) . . . . . . . . 51 18. Interoperability with Earlier Record Generations . . . . . . 52 19. Implementation Status . . . . . . . . . . . . . . . . . . . . 53 20. References . . . . . . . . . . . . . . . . . . . . . . . . . 54 20.1. Normative References . . . . . . . . . . . . . . . . . . 54 20.2. Informative References . . . . . . . . . . . . . . . . . 56 Appendix A. Recognition Pseudocode . . . . . . . . . . . . . . . 58 Appendix B. Document History . . . . . . . . . . . . . . . . . . 59 Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 66 1. Introduction Model Context Protocol (MCP) [MCP] is an open protocol for structured interaction between AI agents and tool-providing servers. A complete agent-to-organisation-to-individual interaction chain has three distinct discovery requirements: 1. *Service discovery.* Where is the MCP server endpoint? What transport does it speak? What cryptographic key authenticates it? This is the question v01 of this document answers via the _mcp. record. Morrison Expires 23 January 2027 [Page 4] Internet-Draft MCP DNS Discovery July 2026 2. *Organisational identity bootstrap.* Who is the organisation operating the server? What is its legal entity? Where is it registered? Under what regulatory frameworks does it operate, and which automated access pathways must it refuse to participate in? This is the question v02 answers via the _org-alter. record. 3. *Individual identity recognition.* Who is the Sovereign-tier person bound to a ~handle hosted under the domain? What public key signs their statements? What append-only log anchors the lifecycle of their identity? How may their envelope be revoked? This is the question v03 introduces via the _alter. record. The three questions are distinct. An MCP client may need to discover an endpoint without caring about the operator's identity or any individual handle. An onboarding wizard installing an org-alter instance may need to read the operator's identity without caring (yet) about the MCP endpoint. A recognition verifier (resolving an alter:~alice URI) needs the individual envelope without necessarily invoking an MCP session. Conflating any two of these into a single TXT record would force every consumer to parse fields it does not need and would crowd the 255-octet character-string limit. Splitting them across three underscore-prefixed labels mirrors the pattern established by DKIM [RFC6376] (_domainkey._domain) and DMARC [RFC9989] (_dmarc._domain), where each record serves a single semantic purpose. SPF [RFC7208] and MTA-STS [RFC8461] set the same precedent for carrying policy in a TXT record under a reserved label. This revision is fully backward-compatible with v01 and v02. Implementations that consume only the _mcp. record continue to work unchanged. Implementations that wish to bootstrap an org- alter identity may additionally query _org-alter.. Implementations that wish to recognise an individual ~handle may additionally query _alter.. This document stands alone. Earlier revisions deferred the envelope schema, the JSON Canonicalisation Scheme (JCS, [RFC8785]) serialisation, and the verification algorithm to a companion specification a reader could not fetch, which made this document unimplementable by anyone outside its author's organisation. They also incorporated the _mcp and _org-alter record formats and procedures by reference to revisions 01 and 02, by section numbers that named the wrong sections, so a reader who followed a pointer arrived at the wrong place in the right document. Both deferrals are removed. Morrison Expires 23 January 2027 [Page 5] Internet-Draft MCP DNS Discovery July 2026 All three record formats (Section 5, Section 6, Section 7), all three procedures (Section 12.1, Section 12.2, Section 12.3), the signing input (Section 7.4) and the caching rules (Section 13) are given here in full. An implementer needs no other document in this series. Revisions 01 and 02 are cited where this document records what they said, and are cited informatively, because nothing here depends on fetching them. The individual-identity layer is grounded, as the organisational layer is, in the identity field framework of [MORRISON-IFT]. A ~handle is not a reserved alphanumeric slot but a durable recognition attractor in the identity field. A DNS record provides a discrete checkpoint into that field: the envelope published at _alter. is the handle-holder's own canonical declaration, signed by their Ed25519 key and consumable by any resolver with access to a DNSSEC- validating recursive resolver. It also carries a reference to an IdentityLog root, whose status as a trust anchor Section 10 sets out honestly and narrowly. 1.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Terminology (Terminology from v01 and v02 is retained. Additional terms introduced in this revision are defined below.) Envelope An Ed25519-signed JSON object binding a ~handle to a public key, an IdentityLog root reference, an inception timestamp, a revocation hash commitment, a signature algorithm tag, a detached signature, and a caveats array. The envelope is the unification primitive of the ALTER identity architecture. The TXT grammar that carries the seven required envelope fields across DNS, and the signing input over which they are verified, are specified in Section 7 of this document. ~handle A Sovereign-tier identifier, leading tilde mandatory (e.g. ~alice). Bot-tier handles carry a .bot suffix (e.g. ~example- bot.bot); Instrument-tier handles use the prefix ~cc- (e.g. ~cc- example-model). IdentityLog An append-only transparency log recording envelope Morrison Expires 23 January 2027 [Page 6] Internet-Draft MCP DNS Discovery July 2026 lifecycle events (mint, caveat-add, revocation, key-rotation), whose root the ilr= field of Section 7 references. Revision 04 of this document described a Signed Tree Head emitted every minute and cross-anchored to four named witness surfaces. No such witness federation exists, and the description is withdrawn. The log's cadence, its witness protocol, and the client profile for checking it are NOT specified by this document and are not yet specified anywhere a reader can fetch. Section 10 states what a resolver may and may not conclude from ilr= in the meantime. Organ A broadcast surface for the envelope. The three organs are: DNS publication (this document), the local alter-runtime L3 daemon, and a hardware-anchored device-organ quorum. The term is canonical; do not substitute "channel", "vector", or "emitter" at the architectural level. Recognition The act of a resolver observing and verifying an envelope on cryptographic merit. Recognition is distinct from claim: publishing a TXT record is not a claim of identity, it is an observable assertion that the resolver may verify or reject. No field of this document carries a claim verb; resolvers recognise envelopes, they do not honour publisher assertions about them. DNSSEC Validation The act of an authenticating DNS resolver verifying the RRSIG chain from the root trust anchor to the TXT RRset, per [RFC4033], [RFC4034], and [RFC4035], and setting the AD bit on the response delivered to the stub client. DANE TLSA Pin A DNS TLSA resource record [RFC6698] binding a server's leaf TLS certificate (or the public key therein) to the zone that hosts the envelope. In this document, the pin applies to the MCP endpoint at mcp.. alter: URI A dispatch URI scheme provisionally registered with IANA per [RFC7595]. Handler guidance is given in Section 11 of this document. (Terms from v02, Org-Identity Record, Identity Bootstrap, Canonical Entity Identifier, Regulatory Refusal Marker, are retained.) 3. Related Work Several drafts now publish agent discovery data in DNS, and they arrived at overlapping vocabularies independently. Morrison Expires 23 January 2027 [Page 7] Internet-Draft MCP DNS Discovery July 2026 Two of them are called AID and they are different documents. [AGENT-AID] is "Agent Identity and Discovery", and [DNS-AID] is "DNS for AI Discovery". A reader who meets both should not have to work that out from context, so this document names them apart. [AGENT-AID] is the closest neighbour to the service-discovery record of this document, and it came first. It publishes a TXT record at _agent. carrying a leading v=aid1 version tag and semicolon- delimited key=value pairs, which give the endpoint URI (u), a protocol token (p), an authentication hint (a), and optionally an Ed25519 public key for endpoint proof (k) with a rotation identifier (i). The _mcp record of Section 5 reaches the same three facts, an endpoint, a protocol, and a key, in an underscore-prefixed TXT record with a leading version tag and semicolon-delimited pairs, and both patterns are derived from DKIM [RFC6376]. Neither document copied the other. Two drafts landed on one shape because DKIM is where anyone publishing a key in TXT learns to look, and [AGENT-AID] published that shape first, in March 2026. The two compose, and [AGENT-AID] says how. Its abstract states that AID is intentionally small and that after discovery, protocol- specific mechanisms such as MCP handle communication and capability negotiation, and its protocol registry already carries mcp as a token. This document is what that token defers to. [AGENT-AID] answers where an agent is and which protocol to speak to it; the _mcp record answers what an MCP endpoint then requires, its transport, its authentication, its capability scope and its key epoch; and the _org- alter record of Section 6 answers who is behind the endpoint, with a legal entity, a registry identifier, operating regions and regulatory refusal markers. A deployment may publish both, and a client that learns p=mcp from _agent. may query _mcp. for the depth [AGENT-AID] deliberately leaves out. The keys bind different things, which is why publishing both is not a duplication. The k of [AGENT-AID] binds a key to an endpoint, and proves control of the server that answers. The _alter and _org-alter records bind a key to a ~handle or to a legal entity, with a log root and a revocation commitment. One proves the door is the right door. The other says who owns the building. Revision 01 of this document made the first of these points, in a section titled "Relationship to Agent Identity and Discovery (AID)". Revision 02 dropped the prose and kept the reference, and revisions 03 and 04 dropped both. That was an error and this revision reverses it. Morrison Expires 23 January 2027 [Page 8] Internet-Draft MCP DNS Discovery July 2026 [DNS-AID] specifies discovery of AI agents through DNS. It carries connectivity in SVCB records with TXT as a fallback, an alpn parameter that may hold the transport, an application-layer agent protocol, or both (alpn=mcp,h2,h3), and an optional bap parameter for the agent protocol alone, so that consumers can match on the agent protocol without parsing transports out of alpn. It predates this document's treatment of the same question and is the most substantial neighbouring work in the space. It operates over unicast DNS, as this document does, and the two are complementary rather than competing. DNS-AID addresses agent discovery generally, while this document addresses one protocol family in depth and adds the identity records that carry a signed envelope. [MDNS-AGENT] specifies zero-configuration discovery over mDNS and DNS-SD. Its proto parameter names the agent protocol family, and it defines exactly one value for it, proto=a2a, saying that A2A is the only instantiation included in that document and leaving other agent protocols to future work. It defines no registry for the key. The slot this document would occupy in that vocabulary, proto=mcp, is therefore open rather than taken, and the two documents agree on what the key MEANS, which is the part that matters for an implementer reading both. Its Section 7 puts discovery across links out of scope while noting that existing wide-area and aggregated DNS-SD facilities can provide it without changing the descriptor, so its scope is not permanently local. No record is ever shared with this document's records regardless, because the owner names and service types differ. [MDNS-ARCHITECT] publishes registered agents through standard A, SVCB, and SRV records at a registry, with a worked SVCB example that puts the agent protocol and the transport side by side (SVCB 0 mcp ... alpn=h2). It is a third reading of the same axis, and it strengthens the case for a shared distinction rather than weakening it. Morrison Expires 23 January 2027 [Page 9] Internet-Draft MCP DNS Discovery July 2026 [SAIP] is a neighbour to the identity records of this document rather than to its service-discovery record. It publishes an agent's Ed25519 public key in an underscore-prefixed TXT record at _saip., with a leading v= version tag, deriving its pattern, as this document does, from DKIM [RFC6376] and SPF [RFC7208]. Its Section 10, "Trust and Attestation Discovery", specifies that publication and the discovery of the key from it, so the two documents are solving the same problem at the same layer: how a verifier finds the key that a signature must check against. The bindings differ. The _saip record binds a key to a vendor's declared network footprint, carrying authorised ASNs, authorised IP prefixes, and an expiry. The _alter record of Section 7 binds a key to a ~handle, with a log root and a revocation commitment. A deployment that wanted both could publish both, and nothing in either record's owner name or field set collides with the other. These drafts would serve their readers better with one vocabulary. An implementer reading two of them should not have to hold two meanings for one key in their head. The neighbouring drafts keep the agent protocol and the transport apart, each in its own way. [MDNS-AGENT] defines proto as the agent protocol identifier and never as a transport, and carries the connection data in the SRV record instead. [MDNS-ARCHITECT] defines no proto key at all, and keeps the agent protocol distinct from the wire protocol inside its SVCB record, the one in the mcp position and the other in alpn. Neither of them puts a transport where the agent protocol belongs. Revision 01 of this document did exactly that, so revision 01 is the odd one out, and it is the reading that has to give way. The alignment adopted here is therefore one parameter for the agent protocol family and a second, separate parameter for the transport or binding. The transport parameter is named transport because the Model Context Protocol specification already calls this axis by that name, so an MCP implementer meets one term, not two. This document keeps a third axis separate again. transport names the binding (streamable-http, sse), and the wire protocol underneath it (h2, h3) is left to the alpn service parameter of SVCB and HTTPS records [RFC9460], where DNS already carries it. [DNS-AID] permits alpn to hold the transport, the agent protocol, or both, and a reader of that draft and this one should know that this document does not overload alpn in the same way. Three axes are made explicit here rather than two, and the third is not carried in TXT at all. Morrison Expires 23 January 2027 [Page 10] Internet-Draft MCP DNS Discovery July 2026 4. Why TXT rather than SVCB The neighbouring drafts carry their connectivity data in SVCB records, with TXT as a fallback. This document is the reverse, TXT is the primary carrier. The reason is the payload, not a rejection of SVCB. An _mcp record's value is almost entirely opaque tokens the resolver does not interpret, an endpoint URL, a public key, a capability list, an attestation scope. SVCB earns its place when a resolver or a connection library acts on the parameters directly, selecting a transport, following an alpn, choosing a port. It adds a registered SvcParamKey per field and a priority-ordered target list. For a record whose fields are consumed by an MCP client after resolution, and not by the resolver, that machinery is overhead without a matching benefit, and a TXT string is the lighter carrier. Where a field IS resolver-actionable, this document defers to SVCB rather than duplicating it. The wire protocol lives in the SVCB or HTTPS alpn parameter [RFC9460], never in this TXT record, for exactly that reason. An operator who wants SVCB-based transport selection publishes an HTTPS record for the endpoint host in the ordinary way, and the two records coexist. 5. Record Format: _mcp. (Service Discovery) This section defines the Discovery Record introduced in v01. It is given here in full. Revisions 03 and 04 incorporated it by reference, by a section number that named the wrong section, and a reader could not follow the pointer. 5.1. DNS Location The Discovery Record is a DNS TXT resource record [RFC1035] published at the label _mcp prepended to the Policy Domain: _mcp.. IN TXT "" The underscore prefix conforms to the conventions established in [RFC8552] for globally scoped, underscore-prefixed DNS node names. Multiple TXT resource records MAY be published at the same DNS name. Where multiple records exist, each MUST independently conform to the syntax defined in this section. Clients MUST evaluate all returned records and select among them using the priority field as described below. Morrison Expires 23 January 2027 [Page 11] Internet-Draft MCP DNS Discovery July 2026 5.2. ABNF Grammar The record value is a semicolon-delimited sequence of key-value pairs. The following ABNF [RFC5234] defines the syntax: mcp-record = version *( ";" SP field ) version = "v=mcp1" field = url-field / proto-field / transport-field / pk-field / epoch-field / cap-field / attest-field / scope-field / priority-field / ttl-field / ext-field / unknown-field url-field = "url=" https-uri proto-field = "proto=" proto-value transport-field = "transport=" transport-value pk-field = "pk=" algo ":" base64url epoch-field = "epoch=" 1*DIGIT cap-field = "cap=" cap-csv attest-field = "attest=" attest-csv scope-field = "scope=" scope-csv priority-field = "priority=" 1*DIGIT ttl-field = "ttl=" 1*DIGIT ext-field = "ext=" https-uri unknown-field = token "=" *qtext https-uri = "https://" *uri-char uri-char = %x21-3A / %x3C-7E ; printable ASCII, excluding ";" (%x3B) and SP. ; A URI carries no raw space, so admitting one here ; would let a url= value swallow the field after it. qtext = %x20-3A / %x3C-7E ; printable ASCII and SP, excluding ";" (%x3B), ; which delimits one field from the next. A value ; that could contain ";" could swallow the delimiter. algo = "ed25519" base64url = 1*( ALPHA / DIGIT / "-" / "_" ) proto-value = token transport-value = token cap-csv = cap-token *( "," cap-token ) cap-token = token attest-csv = attest-token *( "," attest-token ) attest-token = token scope-csv = scope-token *( "," scope-token ) scope-token = "tools" / "resources" / "prompts" / "sampling" / "identity" / token token = 1*( ALPHA / DIGIT / "-" / "_" ) Morrison Expires 23 January 2027 [Page 12] Internet-Draft MCP DNS Discovery July 2026 unknown-field matches ONLY a field name this document does not define. ABNF has no way to say "any token except these", so the exclusion is stated here, and it is normative. Where a field name IS defined above, the field MUST be parsed by that field's own rule. A record in which a defined field's value does not satisfy its own rule is MALFORMED, and a client MUST discard it, exactly as Section 12.1 discards a record whose url is not a valid HTTPS URI. A client MUST NOT re-read such a field as an unknown-field. Without this rule the alternation would swallow every defect it was written to exclude: url=https://x.com priority=5 would parse as an unknown field named url rather than as the malformed url field it is. The grammar admits any token in proto and in transport, and that is deliberate. Syntactic admissibility is not definition. Revision 01 admitted any token in proto and records in the wild carry transport values there, so a resolver MUST be able to PARSE such a record before it can decide what to do with it, and the reading rule of Section 5.3.5 is what decides. A grammar that rejected those records at the parser would leave the reading rule with nothing to read. The values this document DEFINES are enumerated in the field definitions below, and they are few. proto has exactly one defined value, mcp. transport has exactly three, streamable-http, sse, and stdio-url. Those two sets are disjoint, so no value is defined for both fields. A transport value appearing in proto is RECOGNISED there, under Section 5.3.5, and is not DEFINED there; the distinction is what makes the previous sentence true. 5.3. Field Definitions 5.3.1. v (REQUIRED) Protocol version identifier. MUST be the literal string mcp1. MUST appear as the first field in the record. Clients MUST reject any record whose v field is absent, is not the first field, or contains a value other than mcp1. This version gate enables future incompatible revisions of the record format. A future version mcp2 would indicate breaking changes to field semantics or discovery flow. 5.3.2. url (REQUIRED) The HTTPS URL of the MCP server endpoint. MUST use the https scheme. MUST be a syntactically valid URI per RFC 3986. This is the entry point for MCP session establishment. Morrison Expires 23 January 2027 [Page 13] Internet-Draft MCP DNS Discovery July 2026 Clients MUST NOT attempt to connect to URLs using schemes other than https. Servers MUST present a valid TLS certificate for the hostname in the URL. 5.3.3. proto (OPTIONAL) The agent protocol family the endpoint speaks. Default value: mcp. For a record published at _mcp. the only value defined by this document is mcp; the field is retained because the same key, with the same meaning, is used by neighbouring discovery drafts (see Section 3) and a client that reads several of them should not have to special-case this one. proto does not name a transport. It does not carry streamable-http, sse, h2, h3, or any other binding. The transport is carried by the transport field below. A record published under revision 01 may nonetheless carry a transport value here, and Section 5.3.5 says exactly how to read one. The field is OPTIONAL, but not unconditionally. A publisher that emits a transport field MUST also emit proto=mcp, for the interoperability reason given in Section 5.3.5. Omitting proto is permitted only where transport is also omitted. 5.3.4. transport (OPTIONAL) The MCP transport binding used by the server. Default value: streamable-http. Defined values: * streamable-http, the HTTP-based streaming transport (default). * sse, the HTTP+SSE transport of MCP protocol version 2024-11-05, retained for deployed servers. The Model Context Protocol specification marks this transport superseded by streamable-http. It is listed so an existing server stays discoverable, not as a recommendation for new deployments. * stdio-url, a URL pointing to a signed launch descriptor for a stdio-based server (descriptor format out of scope). This is a discovery convenience defined by this document, not one of the MCP specification's own transport names. The field is named transport because that is the term the Model Context Protocol specification itself uses for this axis, so an _mcp record and an MCP client configuration name the transport the same way. Morrison Expires 23 January 2027 [Page 14] Internet-Draft MCP DNS Discovery July 2026 Implementations SHOULD support at least streamable-http. A client that meets a transport value it does not recognise MUST skip the record and proceed to the next record by priority, or to HTTPS fallback. The wire protocol beneath the transport (h2, h3, http/1.1) is NOT carried in this record. It is already expressible as the alpn service parameter of an SVCB or HTTPS resource record [RFC9460], and duplicating it in TXT would create two sources of truth for one fact. 5.3.5. Reading a record published before this revision Revision 01 of this document defined proto as the transport, so records in the wild carry proto=streamable-http, proto=sse, or proto=stdio-url. Revision 01 also admitted ANY token in that field, and required a client that met a proto value it did not recognise to SKIP the record. Both of those behaviours are preserved here. Such records remain valid and MUST be read as follows. A client reading an _mcp record determines two things, the protocol family first and the transport second. Taking them in the other order is what makes an unrecognised value look harmless, so the order is normative. *Step A, the protocol family.* The family is mcp where any one of the following holds: * proto is absent; * proto carries mcp; * proto carries one of the three values defined for transport in Section 5.3.4. This is the revision 01 form, in which the transport was written into proto. Where proto carries any other value, it names a protocol family this document does not define. The client MUST skip the record and proceed to the next record by priority, or to HTTPS fallback. It MUST NOT treat the value as a transport, and it MUST NOT apply a default transport to the record. This holds whether or not a transport field is also present: a record reading transport=streamable-http; proto=websocket is skipped, because the family is unknown, and the presence of a readable transport does not make an unknown family speakable. *Step B, the transport.* A client reaches this step only where Step A yielded the family mcp. Morrison Expires 23 January 2027 [Page 15] Internet-Draft MCP DNS Discovery July 2026 * Where transport is present and carries one of the three values defined in Section 5.3.4, that value is the transport, and any transport value carried in proto MUST be ignored. * Where transport is present and carries any other value, the client MUST skip the record, and MUST proceed to the next record by priority or to HTTPS fallback (Section 5.3.4). * Where transport is absent and proto carries one of the three defined transport values, that value is the transport. This is the revision 01 form. * Where transport is absent and proto is absent or carries mcp, the transport is streamable-http. The skip in Step A is the rule that matters, and it is written out because the obvious reading gets it wrong. Revision 01 admitted any token in proto, so proto=websocket was a syntactically legal record, and every conformant revision 01 client SKIPPED it, because revision 01 required a skip on an unrecognised proto value. A client that instead read an unrecognised proto value as a protocol family, and then applied the default transport, would open a streamable-http session against a server that never offered one. That record was unusable under revision 01 and it stays unusable here. Preserving the skip is what keeps the two revisions interoperable. Widening the rule to absorb any unknown token would do the opposite, because it would newly accept records that no client could ever use. A publisher that emits a transport field MUST also emit proto=mcp. This is not decoration. A revision 01 client does not know the transport field, and its own forward-compatibility rule tells it to IGNORE any field it does not know, so it reads only proto. A record carrying transport=streamable-http beside proto=sse would therefore resolve to streamable-http under this revision and to sse under revision 01, which is one record and two transports. Setting proto=mcp alongside transport removes the divergence, because a revision 01 client then finds no transport it recognises in proto and skips the record rather than reaching a different endpoint state than a current client would. Publishers SHOULD move to the two-field form. No flag day is required, because the two forms are distinguishable by inspection, and because no value is defined for both fields (Section 5.2). Morrison Expires 23 January 2027 [Page 16] Internet-Draft MCP DNS Discovery July 2026 5.3.6. pk (OPTIONAL) Ed25519 public key for endpoint verification, encoded as ed25519: where is the raw 32-byte public key encoded per [RFC4648] Section 5, without padding. Where present, the pk field provides a cryptographic binding between the DNS record and the MCP server. Clients MUST verify that the key matches at least one of the following: 1. A key in the server's TLS certificate SubjectPublicKeyInfo. 2. The signing key used in HTTP Message Signatures [RFC9421] on MCP responses. 3. The key declared in the Server Card [SEP-1649] served by the endpoint. If verification fails, the client MUST treat the server as untrusted and SHOULD NOT proceed with the MCP session. 5.3.7. epoch (OPTIONAL) A monotonic non-negative integer that increments on every key rotation. Default value: 0. Signed claims or attestations issued by the MCP server carry a key identifier (kid) of the form :#. Verifiers resolve the Discovery Record, extract the current epoch, and apply the following rules: * Claims with epoch == current are valid, subject to temporal checks. * Claims with epoch < current are revoked unless the claim's expiry timestamp predates the rotation event. * Claims with epoch > current MUST be rejected as either forgeries or evidence of a stale verifier DNS cache. The epoch field enables epoch-based revocation without external Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) infrastructure. Incrementing the epoch revokes all outstanding claims issued under prior epochs, subject to the grace period defined by each claim's expiry. Morrison Expires 23 January 2027 [Page 17] Internet-Draft MCP DNS Discovery July 2026 5.3.8. cap (OPTIONAL) Capability tier advertised by the server, expressed as a comma- separated list of tokens. This field provides a coarse hint to clients about the functional scope of the server. No normative semantics are defined for specific capability values in this document. Protocol extensions MAY define capability tokens and their semantics. Clients that do not recognise a capability token MUST ignore it. 5.3.9. attest (OPTIONAL) A comma-separated list of attestation types that the MCP server declares it is authorised to issue. The value enumerates claim types that downstream verifiers will accept from this issuer. Defined values, extensible: * employ, current employment affiliation. * contract, contractual or freelance engagement. * alumnus, former affiliation. * director, board or directorial role. * member, generic membership (professional body, association). * contrib, verified contribution without formal affiliation. Verifiers MUST reject any attestation claim whose type is not present in the issuer's attest field. This provides a structural defence against capability creep: the domain's published attestation scope is the upper bound on what its claims can assert. Forward compatibility: unknown attestation values MUST be ignored, not rejected. A verifier encountering attest=employ,fellow where fellow is undefined treats the record as attest=employ and proceeds. 5.3.10. scope (OPTIONAL) Comma-separated list of MCP primitives supported by the server. Defined values: * tools, the server exposes callable tools. * resources, the server exposes readable resources. Morrison Expires 23 January 2027 [Page 18] Internet-Draft MCP DNS Discovery July 2026 * prompts, the server exposes prompt templates. * sampling, the server supports LLM sampling requests. * identity, the server supports identity resolution queries. Unknown values MUST be ignored. This field is advisory; the authoritative capability set is declared during the MCP initialize handshake. 5.3.11. priority (OPTIONAL) A non-negative integer. Default value: 10. Where multiple Discovery Records exist at the same DNS name, clients MUST sort records by priority in ascending order and attempt connection to lower-valued records first. This field enables multi-server failover without external load balancing. If connection to the highest-priority server fails, the client proceeds to the next record. 5.3.12. ttl (OPTIONAL) Advisory TTL in seconds for client-side caching of the parsed Discovery Record metadata. Clients MAY use this value to avoid repeated DNS lookups when the DNS TTL is shorter than desired. The DNS TTL itself remains authoritative for cache expiry of the raw DNS response; the ttl field applies to post-parse metadata caching only. 5.3.13. ext (OPTIONAL) An HTTPS URL pointing to a protocol-extension document. The format and semantics of the extension document are defined by the protocol extension, not by this specification. This field enables protocol-specific extensions (identity protocols, payment protocols, agent-to-agent negotiation) to attach additional metadata without consuming space in the DNS TXT record. The extension document MUST be served over HTTPS. Clients that do not recognise or support the extension MUST ignore this field. 5.4. Forward Compatibility Implementations MUST ignore unknown fields. A parser encountering a field name that it does not recognise MUST skip that field and continue parsing the remaining fields. This rule ensures that future extensions to the record format do not break existing implementations. Morrison Expires 23 January 2027 [Page 19] Internet-Draft MCP DNS Discovery July 2026 Ignoring an unknown FIELD is not the same act as skipping a record on an unrecognised VALUE in a field this document defines. The first is required here; the second is required by Section 5.3.4 and Section 5.3.5. Breaking changes to the semantics of existing fields require a version bump, for example v=mcp2. 5.5. Multi-String Concatenation DNS TXT resource records are limited to 255 bytes per character- string [RFC1035]. Where a Discovery Record exceeds 255 bytes, the record MUST be split across multiple character-strings within a single TXT RDATA, which the DNS resolver concatenates per [RFC7208] Section 3.3. Example of a multi-string record: _mcp.example.com. IN TXT ( "v=mcp1; url=https://mcp.example.com; " "pk=ed25519:LongBase64UrlEncodedPublicKeyValueHere; " "epoch=3; attest=employ,contract,alumnus; scope=tools,identity" ) Parsers MUST concatenate all character-strings within a single TXT RDATA before parsing the semicolon-delimited fields. Parsers MUST NOT treat each character-string as an independent record. 6. Record Format: _org-alter. (Identity Bootstrap) This section defines the Org-Identity Record introduced in v02. It is given here in full, for the same reason Section 5 is. 6.1. DNS Location The Org-Identity Record is a DNS TXT resource record [RFC1035] published at the label _org-alter prepended to the Policy Domain: _org-alter.. IN TXT "" The underscore prefix conforms to the conventions established in [RFC8552] for globally scoped, underscore-prefixed DNS node names. A domain MAY publish a _mcp. record without an _org- alter. record (service-only deployment), or an _org- alter. record without a _mcp. record (identity-only deployment), or both (full deployment). The recommended pattern for any operator running an org-alter instance is to publish both. Morrison Expires 23 January 2027 [Page 20] Internet-Draft MCP DNS Discovery July 2026 Multiple TXT resource records MAY be published at the same DNS name (e.g., for staged identity rotation). Clients MUST evaluate all returned records and select the one with the highest epoch field. 6.2. ABNF Grammar The record value is a semicolon-delimited sequence of key-value pairs. The following ABNF [RFC5234] defines the syntax: Morrison Expires 23 January 2027 [Page 21] Internet-Draft MCP DNS Discovery July 2026 orgalter-record = version *( ";" SP field ) version = "v=alter1" field = org-field / entity-field / entity-type-field / founded-field / regions-field / regulated-field / bootstrap-field / mcp-policy-field / epoch-field / pk-field / attest-field / ext-field / unknown-field org-field = "org=" text-value entity-field = "entity=" registry ":" text-value entity-type-field = "entity-type=" text-value founded-field = "founded=" date-fullyear regions-field = "regions=" region-csv regulated-field = "regulated=" framework-csv bootstrap-field = "bootstrap=" https-uri mcp-policy-field = "mcp-policy=" policy-token epoch-field = "epoch=" 1*DIGIT pk-field = "pk=" algo ":" base64url attest-field = "attest=" attest-csv ext-field = "ext=" https-uri unknown-field = token "=" *qtext registry = "abn" / "acn" / "ein" / "ch" / "cro" / "lei" / token text-value = 1*qtext qtext = %x20-3A / %x3C-7E ; printable ASCII and SP, excluding ";" (%x3B), ; which delimits fields. A legal entity name carries ; spaces, so VCHAR alone cannot express one. region-csv = region-token *( "," region-token ) region-token = 2ALPHA ; ISO 3166-1 alpha-2 framework-csv = framework-token *( "," framework-token ) framework-token = "disp" / "itar" / "ear" / "hipaa" / "gdpr" / "soc2" / "iso27001" / "iso42001" / "essential8" / "aprs" / token policy-token = "open" / "refuse-automated" / "refuse-tenant" / "refuse-all" / token date-fullyear = 4DIGIT [ "-" 2DIGIT [ "-" 2DIGIT ] ] algo = "ed25519" base64url = 1*( ALPHA / DIGIT / "-" / "_" ) https-uri = "https://" *uri-char uri-char = %x21-3A / %x3C-7E ; printable ASCII, excluding ";" (%x3B) and SP. ; A URI carries no raw space. token = 1*( ALPHA / DIGIT / "-" / "_" ) The text-value rule corrects a defect inherited from revision 02, which defined org, entity and entity-type over 1*VCHAR. VCHAR is %x21-7E and excludes the space, so that grammar could not derive Morrison Expires 23 January 2027 [Page 22] Internet-Draft MCP DNS Discovery July 2026 org=Alter Meridian Pty Ltd or entity-type=Pty Ltd, which are the values revision 02's own examples published. A legal entity name carries spaces, so the rule now admits them, and excludes only the semicolon that separates one field from the next. A URI does not carry a raw space, so bootstrap and ext are defined over uri-char rather than text-value. A character class that is right for a name is not thereby right for a URI: admitting SP in a URI value would let it run past its own end and consume the field after it. As in Section 5.2, unknown-field matches ONLY a field name this document does not define. Where a field name IS defined above, the field MUST be parsed by that field's own rule, and a record in which a defined field's value does not satisfy its rule is MALFORMED and MUST be discarded rather than re-read as an unknown field. 6.3. Field Definitions 6.3.1. v (REQUIRED) Protocol version identifier. MUST be the literal string alter1. MUST appear as the first field in the record. Clients MUST reject any record whose v field is absent, is not the first field, or contains a value other than alter1. The version namespace is independent of the _mcp record's v=mcp1 namespace. This allows the two record types to evolve independently. 6.3.2. org (REQUIRED) The canonical legal name of the organisation operating the domain. MUST be the registered legal entity name as it appears in the operator's primary corporate registry, not a trading name or brand. For trading names, see the optional entity-type field. Examples: org=Alter Meridian Pty Ltd org=Red Group Pty Ltd org=International Business Machines Corporation ### entity (RECOMMENDED) A globally-disambiguating canonical entity identifier, prefixed by its registry namespace. Defined registries: * abn: -- Australian Business Number (11 digits, no spaces). Morrison Expires 23 January 2027 [Page 23] Internet-Draft MCP DNS Discovery July 2026 * acn: -- Australian Company Number (9 digits, no spaces). * ein: -- US Employer Identification Number (NN-NNNNNNN). * ch: -- UK Companies House number (8 alphanumeric). * cro: -- Irish Companies Registration Office number. * lei: -- Legal Entity Identifier (20 alphanumeric per ISO 17442). Additional registries MAY be defined; clients MUST treat unknown registry namespaces as opaque identifiers. Example: entity=abn:54696662049 The entity field is the primary anti-impersonation defence for the identity layer: a domain claiming to be Alter Meridian Pty Ltd without an ABN that resolves to that name in ABR Lookup is detectable as a mismatch by any verifier with access to the public registry. 6.3.3. entity-type (OPTIONAL) A short human-readable label for the entity's type, drawn from its jurisdiction's vocabulary. Examples: Pty Ltd, LLC, GmbH, SAS, non- profit. This field is advisory and is intended for display to humans; it is not a structured taxonomy. 6.3.4. founded (OPTIONAL) The date the legal entity was founded or registered, as YYYY or YYYY- MM or YYYY-MM-DD per ISO 8601. This field is advisory and is used by onboarding wizards and identity verifiers to display "Founded N years ago" or to detect implausibly young entities making strong claims. 6.3.5. regions (OPTIONAL) A comma-separated list of ISO 3166-1 alpha-2 country codes indicating the operator's primary regions of operation. This field is advisory. It is used by onboarding wizards to set sane defaults for jurisdiction-specific behaviour (e.g., currency, locale, public registry preference). Example: regions=AU,NZ,SG Morrison Expires 23 January 2027 [Page 24] Internet-Draft MCP DNS Discovery July 2026 ### regulated (OPTIONAL but STRUCTURALLY SIGNIFICANT) A comma-separated list of regulatory framework tokens under which the operator is bound. Defined values (extensible): * disp -- Australian Defence Industry Security Program. * itar -- US International Traffic in Arms Regulations. * ear -- US Export Administration Regulations. * hipaa -- US Health Insurance Portability and Accountability Act. * gdpr -- EU General Data Protection Regulation. * soc2 -- AICPA SOC 2 Type II. * iso27001 -- ISO/IEC 27001 information security management. * iso42001 -- ISO/IEC 42001 AI management systems. * essential8 -- ASD Essential Eight (ML2 or higher). * aprs -- Australian Privacy Principles / Privacy Act. The presence of any token in this field is a structural promise: the operator declares that they are bound by the named framework and that automated access pathways crossing the regulated boundary MUST be refused. Onboarding wizards reading this field MUST refuse to attempt L5/L6 authenticated access to data stores covered by the declared framework, regardless of whether credentials are available. This converts the DNS record into an out-of-band consent boundary: a remote agent's tooling becomes structurally aware that integration is forbidden before it ever attempts a connection. An agent that ignores this declaration and attempts integration anyway commits a detectable, attributable violation. Forward compatibility: unknown framework tokens MUST be treated conservatively (assume the strictest defensible refusal) rather than ignored. Morrison Expires 23 January 2027 [Page 25] Internet-Draft MCP DNS Discovery July 2026 6.3.6. bootstrap (OPTIONAL) An HTTPS URL pointing to a JSON document containing additional identity bootstrap metadata: a directory of public roster members (if the org chooses to publish one), an organisational logo URL, a canonical public website URL, an attest profile beyond what fits in DNS, and any operator-defined extensions. The bootstrap document MUST be served over HTTPS with a valid TLS certificate for the Policy Domain. The document format is operator- defined; recommended schema is published as https://truealter.com/.well-known/org-alter-bootstrap.schema.json as a non-normative reference. 6.3.7. mcp-policy (OPTIONAL) A single token declaring how the operator's MCP endpoint relates to external automated access: * open -- The MCP endpoint accepts queries from any agent with appropriate authentication. * refuse-automated -- The MCP endpoint exists for human-mediated access only. Automated agents SHOULD NOT initiate sessions. * refuse-tenant -- The MCP endpoint exists, but the operator runs one or more tenants (e.g., an M365 tenant) into which automated access is forbidden. This is the typical declaration for an org- alter instance run by an operator who has DISP-accredited or ITAR- bound systems alongside their public meta-layer. * refuse-all -- The MCP endpoint exists for the operator's own internal use only. External agents MUST NOT attempt connection. Default value, if absent: open. The mcp-policy field complements the regulated field. regulated=disp; mcp-policy=refuse-tenant is the canonical declaration for a defence contractor running an org-alter at the unclassified meta-layer alongside a regulated tenant they will not allow automated agents to enter. 6.3.8. epoch (OPTIONAL) A monotonic non-negative integer that increments on every identity rotation event (e.g., legal entity restructure, change of control, move to a new jurisdiction). Default value: 0. Semantics mirror the epoch field of the _mcp record defined in v01. Morrison Expires 23 January 2027 [Page 26] Internet-Draft MCP DNS Discovery July 2026 6.3.9. pk (OPTIONAL) Ed25519 public key for endpoint verification, encoded identically to the v01 _mcp record's pk field. When present, the same key provides cryptographic binding for both endpoint discovery and identity bootstrap. 6.3.10. attest (OPTIONAL) A comma-separated list of attestation types the operator declares it is authorised to issue, identical in semantics to the v01 _mcp record attest field. Where both records publish an attest field, the values MUST be consistent. An onboarding wizard SHOULD use the union of the two. 6.3.11. ext (OPTIONAL) An HTTPS URL pointing to a protocol-extension document, identical in semantics to the v01 _mcp record ext field. This field is distinct from bootstrap: ext is for protocol-level extensions to the discovery format itself; bootstrap is for operator-level identity metadata. 6.4. Forward Compatibility Implementations MUST ignore unknown fields. This rule, identical to the v01 _mcp record specification, ensures that future extensions to the _org-alter record format do not break existing implementations. 7. Record Format: _alter. (Envelope Publication) This section defines the new Envelope Publication record introduced in v03. The record publishes the seven required fields of the ALTER identity envelope (binding a ~handle to its public key, IdentityLog root, inception timestamp, revocation commitment, and detached signature, under a protocol version) at an underscore- prefixed label under the handle's hosting zone. The envelope schema admits an optional caveats array which is never carried in DNS; this document specifies no transport and no vocabulary for it, so under this document the array is always empty and the signature is computed over an empty array (Section 7.4). The signature algorithm is not a separate field. It is derived from the pk= prefix via the registry of Section 16.7, and enters the signing input under that derivation. 7.1. DNS Location The Envelope Record is a DNS TXT resource record [RFC1035] published at the label _alter prepended to the hosting zone: Morrison Expires 23 January 2027 [Page 27] Internet-Draft MCP DNS Discovery July 2026 _alter.. IN TXT "" The underscore prefix conforms to the conventions established in [RFC8552] for globally scoped, underscore-prefixed DNS node names. Publication of a per-individual envelope at this label is *NOT RECOMMENDED*, for the reasons in Section 7.1.1. That applies to any number of handles. Revision 04 additionally permitted a zone to host more than one ~handle by publishing multiple TXT RRs at this one owner name, with resolvers disambiguating on the h= field; that pattern is the enumeration exposure of Section 7.1.1 in its sharpest form, and a zone MUST NOT use it. A domain MAY publish any combination of _mcp., _org- alter., and _alter. records independently (service- only, identity-only, envelope-only, or any intersection). 7.1.1. Applicability of the Envelope Record Publication of a per-individual envelope in DNS is *NOT RECOMMENDED* for new deployments. Three properties of DNS are the reason. *Enumeration.* Where a zone co-hosts several handles at one owner name, a single query returns the entire set. That is a membership roll, published to the internet, retrievable by anyone, and the individuals listed in it cannot each consent to the disclosure of the others. Even with one handle per zone, DNSSEC's authenticated denial of existence permits zone walking unless NSEC3 or a compact denial scheme is deployed, and this document never required one. *Size.* A conformant envelope does not fit in a single 255-octet character-string, and no conformant envelope is smaller than the limit. Co-hosting a handful of handles at one owner name exceeds the 1232-octet fragmentation budget that current DNS operational guidance assumes, and the RRset grows without bound in the number of handles. The resolution algorithm of Section 12.3 retrieves the whole RRset and filters client-side, so the cost of resolving one handle grows with the number of handles the zone hosts. *Erasure.* A DNS record, once published and cached, cannot be recalled. A mechanism that binds a natural person's identifier to a key in public DNS offers that person no way to withdraw the binding from the caches and passive collectors that have already taken it. Revocation, where this document specifies it at all, marks a binding dead; it does not unpublish it. Morrison Expires 23 January 2027 [Page 28] Internet-Draft MCP DNS Discovery July 2026 These are properties of this mechanism as specified. The envelope format itself, its signing input (Section 7.4), and the verification procedure (Section 12.3) are not implicated by them. 7.2. ABNF Grammar The record value is a semicolon-delimited sequence of key-value pairs. Two grammars are given, because a publisher and a resolver are held to different rules. alter-record is what a conformant publisher MUST emit. alter-accepted is what a conformant resolver MUST accept. Every alter-record is an alter-accepted; the converse does not hold. Revisions 03 and 04 gave the publisher grammar alone, and separately required resolvers to accept records that grammar cannot derive, which is a contradiction this revision removes. The following ABNF (per [RFC5234]) defines the syntax: Morrison Expires 23 January 2027 [Page 29] Internet-Draft MCP DNS Discovery July 2026 ; Publisher emission. A conformant publisher MUST emit this form. alter-record = version ";" SP handle-field ";" SP pubkey-field ";" SP ilr-field ";" SP ts-field ";" SP rev-field ";" SP sig-field *( ";" SP unknown-field ) ; Resolver acceptance. A conformant resolver MUST accept this form. ; The version field stays first. The remaining six required fields ; may arrive in any order, each exactly once, interleaved with any ; number of unknown fields. alter-accepted = version *( ";" SP accepted-field ) accepted-field = handle-field / pubkey-field / ilr-field / ts-field / rev-field / sig-field / unknown-field version = "v=alter1" handle-field = "h=" handle pubkey-field = "pk=" algo ":" base64url ilr-field = "ilr=" base64url ; SHA-256 of IdentityLog root ts-field = "ts=" 1*DIGIT ; inception_ts, Unix seconds rev-field = "rev=" base64url ; SHA-256 of revocation pre-image sig-field = "sig=" base64url ; Ed25519 detached signature unknown-field = token "=" *qtext handle = "~" 1*( ALPHA / DIGIT / "-" / "_" ) [ "." "bot" ] / "~cc-" 1*( ALPHA / DIGIT / "-" / "." ) algo = "ed25519" base64url = 1*( ALPHA / DIGIT / "-" / "_" ) token = 1*( ALPHA / DIGIT / "-" / "_" ) qtext = %x20-3A / %x3C-7E ; printable ASCII and SP, excluding ";" (%x3B), ; which delimits one field from the next. ABNF alone cannot express "each of these six exactly once, in any order", so the cardinality rule is stated here and is normative. A resolver MUST reject any record in which a required field is absent, or in which any field name appears more than once. ABNF cannot express the exclusion either. As in Section 5.2, unknown-field matches ONLY a field name this document does not define. Where a field name IS defined above, the field MUST be parsed by that field's own rule, and a record in which a defined field's value does not satisfy its rule is MALFORMED and MUST be rejected rather than re-read as an unknown field. Morrison Expires 23 January 2027 [Page 30] Internet-Draft MCP DNS Discovery July 2026 The seven keys are REQUIRED. Publishers MUST NOT omit or reorder them, and MUST emit them in the order shown in alter-record. The v field is first for publisher and resolver alike. A resolver MUST reject a record whose v field is absent or is not the first field (Section 7.3.1), so the ordering freedom above extends to the remaining six required fields and to unknown fields, and never to v. Ordering among those six carries no meaning, and a resolver MUST NOT derive any from it. Resolvers MUST tolerate unknown fields wherever they appear, and MUST ignore them, per the forward-compatibility rule of Section 7.5. Field order on the wire has no part in signature computation. The signed bytes are the JCS serialisation specified in Section 7.4, which sorts member names in code-point order and is therefore blind to the order the TXT record used. 7.3. Field Definitions 7.3.1. v (REQUIRED) Protocol version identifier. MUST be the literal string alter1. MUST appear as the first field in the record. Resolvers MUST reject any record whose v field is absent, is not the first field, or contains a value other than alter1. The version namespace v=alter1 on _alter. is independent of the identically-named v=alter1 on _org-alter.. The two namespaces are disambiguated by the enclosing record label and MUST NOT be conflated. Future versions of either record may advance independently (e.g. _alter. may progress to v=alter2 while _org-alter. remains at v=alter1, or the reverse). 7.3.2. h (REQUIRED) The Sovereign-, Bot-, or Instrument-tier ~handle to which the envelope binds. The leading tilde is mandatory. Where a resolver encounters multiple envelope TXT RRs sharing an owner name, h= is the sole field it MAY use to disambiguate them. Publishers MUST NOT create that arrangement (Section 7.1); the rule is retained for resolvers only, so that a record published under revision 04 can still be read. 7.3.3. pk (REQUIRED) An Ed25519 public key prefixed by its algorithm namespace and encoded in base64url without padding per [RFC4648] Section 5: Morrison Expires 23 January 2027 [Page 31] Internet-Draft MCP DNS Discovery July 2026 pk=ed25519: Resolvers MUST reject records whose algorithm prefix is not ed25519 until a future revision registers additional algorithms. The pk value is the verification key for the detached signature in the sig field. 7.3.4. ilr (REQUIRED) Base64url-no-pad SHA-256 digest of an IdentityLog root that the publisher claims was witnessed at envelope creation. Revision 04 required resolvers to cross-reference this value and treated a failure to do so as fatal. That requirement is WITHDRAWN. The field carries a root and nothing more, so it cannot establish that this envelope is recorded in that log, and a resolver MUST NOT rely on it to detect substitution. Section 10 states what it can and cannot establish, and Section 14.3 sets out the forgery it permits. 7.3.5. ts (REQUIRED) Envelope inception timestamp, expressed on the wire as decimal Unix seconds. Resolvers MAY use this field to detect clock skew, evaluate caveat maturity, or reject envelopes with implausibly future inception. In the signing input of Section 7.4 the value is carried as a JSON string of those same decimal digits, never as a JSON number. A resolver that re-types it as a number canonicalises different bytes and every signature fails against it. 7.3.6. rev (REQUIRED) Base64url-no-pad SHA-256 digest of the revocation pre-image. Revocation is effected by revealing the pre-image to the IdentityLog; upon reveal, the envelope is considered revoked and MUST NOT be honoured by resolvers. The rev field is a forward-secure commitment: the pre-image is never published in DNS and is released only at revocation time to the log. Publishers MUST NOT treat removal of the TXT record as revocation. Absence of a record is indistinguishable from misconfiguration; only pre-image reveal is authoritative. Morrison Expires 23 January 2027 [Page 32] Internet-Draft MCP DNS Discovery July 2026 7.3.7. sig (REQUIRED) Base64url-no-pad detached signature over the JCS-canonicalised envelope JSON with the sig field absent. Canonicalisation is specified by [RFC8785]. The signing input is the envelope JSON reconstructed from the parsed TXT fields, plus a signature_alg member derived from the pk= algorithm prefix per the registry of Section 16.7, plus an EMPTY caveats array. The signature algorithm itself is the one named by the pk= prefix. The exact signing input is normative and appears in Section 7.4; it is not restated by reference elsewhere. 7.3.8. Unknown fields Fields not enumerated above MUST be ignored by resolvers per the forward-compatibility rule (Section 7.5). Future revisions of this document MAY register additional envelope fields; such extensions MUST be distinguishable from private-use extensions by registration via the mechanism in Section 16. 7.4. Canonical Serialisation The sig input is constructed as follows. This construction is normative and exhaustive. An implementation that deviates in a key name, a value type, or the membership of the object will produce bytes that no other implementation can verify. 1. Parse the TXT RR character-strings into key-value pairs. 2. Derive signature_alg from the algorithm prefix of the pk value via the Signature Algorithm Registry of Section 16.7. For pk=ed25519:... the derivation yields the string Ed25519. 3. Construct the envelope JSON object, whose members are exactly the six parsed fields that are not sig, plus the derived signature_alg, plus caveats: { "v": "", "h": "", "pk": "", "ilr": "", "ts": "", "rev": "", "caveats": [], "signature_alg": "" } Morrison Expires 23 January 2027 [Page 33] Internet-Draft MCP DNS Discovery July 2026 The keys are the TXT field names, not expanded synonyms. Every value is a JSON string, ts included, which carries the decimal digits of the TXT field verbatim and is NOT converted to a JSON number. caveats is a JSON array and, for any envelope resolved from DNS under this document, it MUST be the EMPTY array. This document defines no caveat transport and no caveat vocabulary, so a non-empty array has no interoperable meaning and an implementation MUST NOT construct one. sig MUST be absent from the signing input, and no other member may be present. These rules make the signed bytes a total function of the TXT record, which is the property v04 lacked. 4. Apply [RFC8785] JSON Canonicalisation Scheme to the object, which sorts the member names in code-point order. The member order shown above is illustrative and has no effect on the canonical bytes. 5. The resulting byte stream is the signing input for the algorithm named in step 2. Verification reverses this construction and checks the detached signature in the sig field against the derived byte stream. v is inside the signing input. A resolver that accepted an envelope whose version was unsigned could be walked down to a weaker version namespace by an on-path rewrite of the v field alone, so the version is signed with everything else. Publishers MUST emit TXT fields in the order given in Section 7.2, but the DNS key=value ordering has no role in signature computation: the signed bytes are always the JCS serialisation of the JSON object. 7.5. Forward Compatibility Resolvers MUST ignore unknown fields in the _alter. record. This rule, identical to the v01 _mcp and v02 _org-alter specifications, ensures that future extensions do not break existing implementations. Publishers MUST NOT introduce new fields that repurpose or overload the seven required field names; new fields MUST use new names registered via the procedure in Section 16. Morrison Expires 23 January 2027 [Page 34] Internet-Draft MCP DNS Discovery July 2026 7.6. Multi-String Reassembly Where the serialised envelope exceeds the 255-octet character-string limit of [RFC1035] Section 3.3.14, publishers SHOULD split at ; boundaries between complete key-value pairs where the pair fits. A publisher MAY split within a key-value pair, and MUST do so where a single pair exceeds 255 octets on its own, which any signature algorithm with a large signature will require. Resolvers MUST concatenate the character-strings of a TXT RR in the order returned by the DNS library (i.e. the RR wire order) BEFORE parsing, so the split point is not observable to the parser and carries no meaning. 8. DNSSEC Requirement The zone publishing an _alter. envelope record MUST be DNSSEC-signed per [RFC4033], [RFC4034], and [RFC4035]. Authoritative servers MUST respond with valid RRSIG coverage for the TXT RRset. Recursive resolvers handling queries for the envelope RRset MUST perform DNSSEC validation and MUST set the AD (Authenticated Data) bit on the response delivered to the stub client. Stub clients (MCP clients, alter-runtime daemons, onboarding wizards, recognition verifiers) consuming _alter. envelope records MUST reject any response that lacks a set AD bit or that fails local RRSIG verification when operating in validating-stub mode. An envelope obtained over an unvalidated DNS path is not an envelope; it is unauthenticated TXT content. Treating it otherwise is a downgrade vulnerability (Section 14.1). This requirement is specific to _alter. records. DNSSEC is RECOMMENDED but not REQUIRED for _mcp. and _org- alter. records in this revision, for backward compatibility with v01 and v02 deployments. Future revisions of this document MAY promote DNSSEC to REQUIRED for the other two records once deployment data justifies the promotion. 9. DANE TLSA Pin The MCP endpoint associated with a published envelope MUST carry a DANE TLSA resource record [RFC6698] binding the endpoint's leaf TLS certificate or SubjectPublicKeyInfo to the zone. The TLSA record MUST be published at: _443._tcp.mcp.. IN TLSA Recommended parameters: Morrison Expires 23 January 2027 [Page 35] Internet-Draft MCP DNS Discovery July 2026 * *Usage field.* 3 (DANE-EE), pin the end-entity certificate directly, with no CA chain reliance. A publisher that explicitly requires CA-chain validation MAY use 1 (PKIX-EE) instead. Publishers MUST NOT use 0 (PKIX-TA) or 2 (DANE-TA) for the envelope organ; the trust basis of the envelope is the end-entity leaf. * *Selector field.* 1 (SPKI), pin the SubjectPublicKeyInfo so that certificate rotations preserving the keypair do not invalidate the record. Selector 0 (full certificate) MAY be used but requires more frequent TLSA republication. * *Matching-type field.* 1 (SHA-256). Matching type 2 (SHA-512) is reserved for future revisions. Clients establishing an MCP session at https://mcp./ in conjunction with a resolved envelope MUST fetch and validate the TLSA record, MUST abort the TLS handshake on mismatch, and MUST NOT fall back to PKIX-only validation on TLSA failure. The TLSA requirement is scoped to envelopes whose MCP session establishment is triggered by the resolved envelope (i.e. when the envelope resolution and the subsequent MCP session are part of a single recognition transaction). MCP clients that do not resolve an envelope (e.g. v01-only clients consuming only _mcp.) are out of scope for this requirement and continue to operate under v01 rules. 10. IdentityLog Cross-Reference The ilr= field of the _alter. record carries a base64url-no- pad SHA-256 digest of an IdentityLog root claimed by the publisher to have been witnessed at envelope creation. Revision 04 of this document required resolvers to cross-reference that value against one of four named witness surfaces, and treated a failure to do so as fatal to recognition. That requirement is WITHDRAWN. It named surfaces that do not exist, and it would not have achieved what it claimed even if they did. What ilr= can and cannot establish, stated plainly: * A resolver that has an independent view of the log MAY confirm that the root named in ilr= is one the log actually published. Morrison Expires 23 January 2027 [Page 36] Internet-Draft MCP DNS Discovery July 2026 * A resolver MUST NOT conclude from ilr= that the envelope in front of it is recorded in that log. The field carries a root and nothing else. It carries no leaf hash, no audit path, and no proof of inclusion, so no resolver can perform that check, and Section 14.3 sets out the forgery this permits. * A resolver MUST NOT treat the presence, absence, or successful lookup of ilr= as a defence against envelope substitution. The field is retained so that withdrawing its security claim does not also force a breaking change to the wire format. It is advisory. The log's leaf hashing, tree construction, cadence, and witness protocol are not specified by this document, and a reader should not assume a specification exists. The revocation check also crosses the IdentityLog. Where a resolver has access to the log's revocation surface, it MUST treat the envelope as revoked, and MUST NOT honour it regardless of the freshness of the TXT RRset, if a pre-image whose SHA-256 equals the rev= field has been revealed there. A reader implementing from this document alone has no such access. The surface that carries reveals is not specified here and is not published anywhere a reader can fetch, so revocation status cannot presently be established from DNS alone. This is a gap in the mechanism, not a property of it, and it is stated rather than papered over. 11. alter: URI Scheme Cross-Reference An IANA-registered URI scheme alter: provides a dispatchable surface for ~handle references: operating-system URI handlers (xdg-mime, LSHandlers, Windows registry, Android intent-filter) invoke a resolver that retrieves the envelope from DNS and verifies it per Section 12.3, falling back to the HTTPS .well-known surface where the DNS record is absent. Registration is provisional per [RFC7595] Section 3. The full registration body, scheme syntax, semantics, encoding considerations, interoperability and security considerations, author and change controller, is submitted to IANA separately from this document. The IANA request is in progress as of the publication date of this revision; the final registration reference will be substituted when available. Morrison Expires 23 January 2027 [Page 37] Internet-Draft MCP DNS Discovery July 2026 Handlers invoked via alter: URIs MUST perform full envelope verification, DNSSEC validation (Section 8), and DANE TLSA binding (Section 9) when establishing any HTTPS session, before acting on any content or directive derived from the envelope. 12. Discovery and Bootstrap Procedures The three procedures below are normative and complete. None of them is a summary of an algorithm specified elsewhere. Revisions 03 and 04 of this document did not restate the first two. They pointed at them by section number, in a document the reader was expected to fetch separately, and every one of those pointers named the wrong section. Nothing is incorporated by reference now. The formats these procedures consume are given in full in Section 5 and Section 6, and the procedures themselves are below. 12.1. Discovery Procedure: _mcp. This is the algorithm an MCP client follows to discover an MCP server associated with a given domain. It is the algorithm of [DNSDISC-01], unchanged, restated here in full. 12.1.1. Input The procedure takes a single input, an Origin Domain. The Origin Domain is typically extracted from an identifier encountered during agent operation, such as an email address (user@example.com yields example.com), a URL (https://example.com/path yields example.com), a handle (~user@example.com yields example.com), or a bare domain. 12.1.2. Algorithm 1. *Normalise.* Convert the Origin Domain to its canonical form: lowercase per [RFC4343], and apply IDNA2008 processing where the domain contains non-ASCII labels. 2. *Construct query name.* Prepend the label _mcp. to the normalised Origin Domain, yielding _mcp... 3. *Query DNS.* Issue a DNS query for _mcp.. IN TXT via the client's configured recursive resolver. Clients SHOULD prefer DoH ([RFC8484]) or DoT ([RFC7858]) to protect query privacy (Section 15.2). 4. *Handle the DNS response.* a. On NOERROR with one or more TXT records, proceed to step 5. Morrison Expires 23 January 2027 [Page 38] Internet-Draft MCP DNS Discovery July 2026 b. On NXDOMAIN, or NOERROR with zero TXT records, proceed to step 8 (HTTPS fallback). c. On SERVFAIL or timeout, the client MAY retry with exponential backoff, or proceed to step 8. 5. *Parse records.* For each TXT RDATA in the response: a. Concatenate all character-strings within the RDATA. b. Split the concatenated string on the ";" delimiter, trimming leading and trailing whitespace from each field. c. Verify that the first field is v=mcp1. If it is not, discard this record. d. Extract all recognised fields. Ignore unknown fields, per the forward-compatibility rule of Section 5.4. e. Verify that the url field is present and carries a syntactically valid HTTPS URL. If it does not, discard this record. 6. *Sort by priority.* Collect all valid records and sort them by priority in ascending order, lowest value first. Records of equal priority MAY be tried in any order. 7. *Connect.* For each record in priority order: a. Establish a TLS connection to the host named in the url field. b. Where the record carries a pk field, verify the key per Section 5.3.6. On failure, skip to the next record. c. Determine the transport by applying the reading rule of Section 5.3.5 to the record's transport and proto fields. Where that rule directs the client to SKIP the record, skip it and proceed to the next record by priority. Otherwise, initiate the MCP session over the transport the rule yields. d. If the MCP initialize handshake succeeds, discovery is complete. e. If connection or handshake fails, proceed to the next record. If all records are exhausted, proceed to step 8. Morrison Expires 23 January 2027 [Page 39] Internet-Draft MCP DNS Discovery July 2026 8. *HTTPS fallback.* Attempt HTTPS-based discovery by fetching https:///.well-known/mcp/server-card.json per [SEP-1649], or https:///.well-known/mcp per [SEP-1960]. If fallback succeeds, proceed with the MCP session. If fallback fails, discovery has failed. This procedure does not consume the _alter. record and imposes no DNSSEC requirement. A client that resolves an envelope executes Section 12.3 instead, which does. 12.2. Identity Bootstrap Procedure: _org-alter. This is the procedure by which an org-alter implementation reads its own DNS records on first install to populate its canonical identity state. It is the algorithm of [DNSDISC-02], unchanged, restated here in full. 12.2.1. Input The procedure takes a single input, the operator's primary domain name, being the Policy Domain under which the operator publishes records. 12.2.2. Algorithm 1. *Query _org-alter. TXT.* Issue a DNS query for the Org- Identity Record. 2. *If found, parse and load.* Extract org, entity, entity-type, founded, regions, regulated, and mcp-policy into the org-alter's identity state. These become the canonical identity declaration the org-alter uses in all subsequent self-reports, brief generation, and external attestation. 3. *If bootstrap= is present, fetch the bootstrap document* over HTTPS. Validate the document's TLS certificate against the Policy Domain. Merge the document's roster, logo, and extension fields into the identity state. Reject the bootstrap document if its TLS certificate is invalid, or if its content does not parse. 4. *Honour regulated= and mcp-policy=* as immutable structural constraints on the org-alter instance. a. If regulated carries any framework token, set the org-alter's boundary policy to refuse, and disable every passive ingester layer. Morrison Expires 23 January 2027 [Page 40] Internet-Draft MCP DNS Discovery July 2026 b. If mcp-policy=refuse-tenant, the org-alter MUST refuse to install any ingester that requires authenticated access to a tenant covered by the declared framework, even where credentials are subsequently provided. c. The wizard SHOULD display these constraints to the operator for confirmation, and MUST NOT allow the operator to override them silently. An operator who wishes to relax a constraint MUST update the DNS record first, then re-run bootstrap. 5. *Cross-check _mcp..* Query the service-discovery record of Section 5. Where both records exist and both publish a pk field, the values MUST match. A mismatch indicates either a configuration error or a key compromise; the wizard MUST refuse to bootstrap under that condition, and MUST surface the discrepancy to the operator. Section 14.6 states how this rule relates to the envelope key of Section 7, which is a distinct key and is not subject to it. 6. *Verify against public registries.* Where the entity field declares a known registry namespace (for example abn:), the wizard SHOULD query the corresponding free public registry and verify that the declared entity identifier resolves to the declared org name. A mismatch is not necessarily fatal, because names change and registries lag, but the wizard MUST surface the discrepancy and MUST require operator confirmation before proceeding. 7. *Persist canonical state.* Write the resolved identity into the org-alter's local identity state, source-citing each field to its DNS or HTTPS origin. 12.2.3. First-Run Cold Start For an operator who has not yet published an _org-alter record at the time of installation, the wizard MUST fall back to interactive seeding. It prompts for org, optionally prompts for entity, and asks whether the operator's environment is regulated. After interactive seeding, the wizard SHOULD generate a draft DNS record value for the operator to publish, which completes the bootstrap loop. Morrison Expires 23 January 2027 [Page 41] Internet-Draft MCP DNS Discovery July 2026 12.3. Envelope Recognition Procedure: _alter. The procedure takes two inputs, a zone and the ~handle to be recognised, and both are REQUIRED. An alter:~ reference supplies both. A resolver that has only a zone, and no handle, cannot execute this procedure. Step 4 selects the record whose h= matches the requested handle, and with no requested handle there is nothing to match against. Such a resolver has not been asked a recognition question, and MUST NOT treat whatever record it finds at the owner name as the answer to one. Given those two inputs, a resolver MUST execute the following steps in order. Steps 1 through 8 and step 10 are FATAL: failure of any of them terminates recognition, and the envelope MUST be treated as unverified. Steps 9, 11 and 12 are ADVISORY in one specific sense, and one only: BEING UNABLE TO PERFORM THEM MUST NOT terminate recognition, because a resolver that cannot reach a surface has learned nothing either way. A POSITIVE finding at one of them is a different matter, and step 12 is the case that bites: a revocation actually observed is FATAL and MUST abort (step 12; Section 10). Revision 04 made every step fatal, including steps that a conformant resolver cannot perform at all, which made verification unreachable. 1. *Query.* Issue a DNS TXT query for _alter... Use DoH or DoT in preference to UDP/53 where operationally feasible. 2. *DNSSEC validation.* Validate the RRSIG chain from the root trust anchor to the TXT RRset (Section 8). Confirm the AD bit on the response when relying on an upstream validating resolver, or locally RRSIG-validate in validating-stub mode. On failure, abort. 3. *Chunk reassembly.* Concatenate character-strings in RR order; parse ;-separated key-value pairs. 4. *Handle disambiguation.* Select the record whose h= field matches the requested ~handle. If no record matches, abort. 5. *Field extraction.* Confirm presence of the seven required fields (v, h, pk, ilr, ts, rev, sig). Reject any record missing any required field, or whose v is not alter1. 6. *Envelope reconstruction.* Build the envelope JSON exactly as Section 7.4 specifies, deriving signature_alg from the pk= prefix and supplying an empty caveats array. 7. *JCS canonicalisation.* Apply [RFC8785] JCS to the envelope with the sig field absent. Morrison Expires 23 January 2027 [Page 42] Internet-Draft MCP DNS Discovery July 2026 8. *Ed25519 verification.* Verify the detached sig over the JCS byte stream using the public key in pk. On failure, abort. 9. *IdentityLog cross-reference (ADVISORY, no longer fatal).* A resolver with an independent view of the log MAY confirm that the root named in ilr= is one the log published. A resolver MUST NOT abort on failure, and MUST NOT treat success as evidence that this envelope is in the log, because ilr= carries no proof of inclusion (Section 10; Section 14.3). Revision 04 made this step fatal on a check that cannot do what it claimed. 10. *DANE TLSA validation.* When establishing an MCP session at mcp. as part of the same recognition transaction, fetch the TLSA record at _443._tcp.mcp.. and gate the TLS handshake on the binding (Section 9). On mismatch, abort. 11. *Caveats evaluation (OUT OF SCOPE for this document).* The envelope schema admits an optional caveats array, which is never carried in DNS. This document specifies neither a transport for it nor a vocabulary, so a resolver implementing this document alone MUST treat the envelope as having no caveats, and MUST verify the signature over an empty caveats array per Section 7.4. A future document may define a caveats surface, and until one does, an envelope whose signer intended caveats cannot be distinguished from one that carries none. That limitation is stated here rather than hidden. 12. *Revocation check (ADVISORY).* Where the resolver has access to the log's revocation surface, consult it. This step is ADVISORY in the sense that being UNABLE to perform it MUST NOT terminate recognition; a resolver that cannot reach a revocation surface has learned nothing either way, and Section 10 says why one implementing this document alone cannot. A POSITIVE result is another matter entirely: if a pre-image whose SHA-256 equals rev= has been revealed, the envelope IS revoked, recognition MUST abort, and the envelope MUST NOT be honoured however fresh the TXT RRset. Morrison Expires 23 January 2027 [Page 43] Internet-Draft MCP DNS Discovery July 2026 An envelope is verified when every FATAL step (1 through 8, and 10) has succeeded AND no ADVISORY step has returned a positive failure. The distinction matters at step 12: a resolver that CANNOT reach a revocation surface has learned nothing and proceeds, while a resolver that OBSERVES a revocation MUST abort and MUST NOT treat the envelope as verified. Steps 9, 11 and 12 are advisory only as to unreachability, because gating verification on a step no conformant implementation can execute would make verification unreachable, and a specification no one can satisfy is not a specification. A verified envelope is the sole admissible input to a recognition-over- qualification gate, and an unverified envelope MUST be refused upstream of any authorisation or trust decision. The twelve-step procedure above is normative and complete. It is not a summary of an algorithm specified elsewhere. 13. Caching The rules for the first two records are those of [DNSDISC-01] and [DNSDISC-02], unchanged, restated here so that a reader need not fetch either document to cache correctly. For _mcp., clients SHOULD cache the parsed record metadata for the duration of the DNS TTL. Where the record carries a ttl field, clients MAY extend the metadata cache to that duration, but MUST re-validate the underlying DNS record when the DNS TTL expires. A client that has connected to an MCP server and verified its pk SHOULD cache the verified key binding and re-validate it on subsequent connections, which is trust on first use with periodic re- verification against DNS. For _org-alter., records SHOULD be cached for the duration of the DNS TTL. An onboarding wizard typically reads the record once at install time and persists the resolved state locally, so the DNS record need not be re-read on every invocation. Wizards MAY re-read it on operator request, on epoch change detected by a periodic background poll, or on identity verification failure. _alter. records SHOULD be cached for the duration of the DNS TTL. Resolvers MUST NOT serve stale envelope TXT past the RRset TTL unless they are themselves validating caches and can re-confirm RRSIG coverage on each serve. Recognition verifiers MAY cache successful verification results locally for a short interval (bounded above by the RRset TTL or 3600 seconds, whichever is smaller) to amortise the cost of repeated JCS and Ed25519 operations. A resolver that is able to perform the revocation check at all (Section 10 sets out why one working from this document alone is not) MUST re-run it on each recognition event, not on each cache refresh. Morrison Expires 23 January 2027 [Page 44] Internet-Draft MCP DNS Discovery July 2026 14. Security Considerations (Security considerations from v01 and v02 are retained. Additional considerations introduced by the envelope layer are below.) 14.1. DNSSEC Downgrade The mandatory DNSSEC requirement in Section 8 is the primary defence against on-path manipulation of envelope TXT content. An attacker who can inject unsigned responses, e.g. via a compromised resolver or a DNS middlebox that strips RRSIG, would otherwise be able to substitute an attacker-controlled envelope at the resolver boundary. Stub clients MUST reject any response lacking AD or failing local RRSIG verification. Operators MUST NOT downgrade the _alter. RRset to unsigned during KSK/ZSK rollover (see [RFC6781] for best-current practice on rollover). 14.2. TLSA Pin Rotation The DANE TLSA requirement in Section 9 binds the MCP endpoint's TLS leaf to a specific hash. Operators rotating certificates MUST publish the new TLSA record before the new certificate is activated on the live listener, with a grace window of at least twice the TLSA RRset TTL. Selector 1 (SPKI) survives rotations that preserve the keypair; selector 0 requires republication on every rotation. Loss of the TLS private key forces certificate reissue and republication of the TLSA record, not silent cert replacement. It does not engage the rev= reveal path, which revokes the identity envelope and has no bearing on a TLS leaf. 14.3. Envelope Substitution An attacker in control of a domain's DNS can publish an arbitrary envelope for any ~handle claimed to be hosted under that zone. The structural defences, and the limit of each, are: 1. *IdentityLog witness. This defence does not hold as specified, and revision 04 was wrong to claim it did.* Revision 04 stated that substitution of a locally-minted envelope that had not been witnessed would fail, and that an attacker would have to corrupt a log mirror. Neither is true of the mechanism this document specifies. ilr= carries a bare tree root and no proof of anything, so a resolver can confirm that the named root was witnessed but CANNOT confirm that the envelope in front of it is a leaf under that root, and no field of Section 7.2 would let it. A zone attacker therefore mints an envelope, copies any genuinely witnessed root out of the public log, signs, and publishes. The result satisfies every check the recognition procedure of Morrison Expires 23 January 2027 [Page 45] Internet-Draft MCP DNS Discovery July 2026 Section 12.3 specifies. As specified, ilr= establishes only that the publisher could read a public value. Implementers MUST NOT rely on ilr= to detect substitution. 2. *Ed25519 signature.* The detached signature binds the envelope to a specific Ed25519 key. An attacker who does not hold the private key cannot forge a valid sig. An attacker who does hold the private key has already compromised the handle; the revocation path (Section 10) is the residual mitigation. 3. *DNSSEC.* Section 8 prevents tampering with the TXT RRset in transit. This does not prevent a malicious zone operator from publishing a malicious envelope, that attack is caught at (1) and (2), but it prevents third-party substitution. 14.4. Revocation Opacity Revocation is effected by revealing the pre-image to the IdentityLog, not by removing the TXT record. Absence of a record is indistinguishable from misconfiguration; resolvers MUST NOT treat absence as revocation. This design is deliberate: a zone briefly unreachable (DNS outage, registrar incident, tooling error) must not accidentally become a revocation event. The cost is that a compromised zone may continue to serve a valid (but intended-to-be-revoked) envelope until the rightful handle- holder reveals the pre-image. This document does not specify where a reveal is published, and Section 10 says why no such surface can be assumed, so revocation is not presently actionable by a resolver working from this document alone. Handle-holders SHOULD establish a pre-committed revocation reveal procedure at mint time. 14.5. Clock Skew and ts= The ts= inception timestamp is advisory: resolvers MAY use it to detect implausibly future envelopes (e.g. minted more than a few hundred seconds after current wall time) but MUST NOT rely on local clock for security-critical decisions. This document specifies no authoritative ordering anchor. ts= is self-asserted by the publisher and is advisory only. 14.6. Cross-Record Key Consistency Where all three records (_mcp, _org-alter, _alter) are published under one zone and each carries a pk field, the values MUST be evaluated for consistency. Two different rules apply, and revision 04 stated only one of them, which contradicted the bootstrap procedure it incorporated by reference. Morrison Expires 23 January 2027 [Page 46] Internet-Draft MCP DNS Discovery July 2026 The _mcp.pk and _org-alter.pk fields are the service key and the organisational key. Step 5 of Section 12.2, restated from [DNSDISC-02], requires them to MATCH where both are published, and requires a bootstrapping wizard to refuse and to surface the discrepancy where they do not. That rule is unchanged. A mismatch across that pair indicates a configuration error or a key compromise. The _alter.pk field is the Sovereign-tier envelope key. It is a structurally distinct key with a distinct purpose, it is NOT subject to the bootstrap match rule, and it MAY differ from both of the others. A resolver MUST NOT treat a difference between _alter.pk and either of the other two as evidence of anything. Where a zone operator has deliberately bound all three to one Ed25519 key, which is a common pattern in a single-operator deployment, a later mismatch indicates either a rotation in progress or a compromise, and resolvers SHOULD surface it. A resolver cannot distinguish that deployment from one that intended three distinct keys, because this document publishes no signal of the operator's intent, so the surfacing is advisory and MUST NOT be fatal. 14.7. Passive-Stream Coupling A publisher SHOULD NOT ride an inferred trait, a passive-stream derivative, or a provenance-tagged attribute on the _alter. record. Revision 04 asserted that none could, calling it a structural property rather than a recommendation, on the grounds that the ABNF enumerates every field a resolver accepts. That claim is WITHDRAWN. The ABNF of Section 7.2 admits unknown-field = token "=" *qtext, which is arbitrary attribute carriage by construction, and Section 7.5 requires resolvers to IGNORE unknown fields rather than reject the record. The qtext rule bounds only the field DELIMITER, so that an unknown field cannot swallow the semicolon and consume the fields after it. It bounds nothing about the field's meaning. Nothing in this document structurally prevents a publisher from riding additional attributes on this owner name, and a resolver MUST NOT infer from a record's conformance that it carries nothing else. Morrison Expires 23 January 2027 [Page 47] Internet-Draft MCP DNS Discovery July 2026 Two consequences follow, and neither was stated before. An unknown- field is NOT covered by the signing input of Section 7.4, which spans the six required fields other than sig, plus the derived signature_alg and an empty caveats array, and nothing else. Any attribute riding the record is therefore UNSIGNED, and a resolver MUST NOT attribute it to the handle-holder. And because a resolver ignores what it does not recognise, the record is a viable carrier for data the envelope was never meant to convey. The privacy implications of passive inference are out of scope for this document; the carriage risk is not, and it is stated here. 15. Privacy Considerations (Privacy considerations from v01 and v02 are retained. Additional considerations introduced by the envelope layer are below.) 15.1. Public Handle Disclosure Publishing _alter. exposes the bound ~handle, its Ed25519 public key, its IdentityLog root, its inception timestamp, and its revocation-hash commitment to any DNS observer. Revision 04 called that exposure by design, on the grounds that the envelope is intended to be publicly verifiable. Public verifiability does not require public enumeration, and Section 7.1.1 sets out why the two came bundled here and should not have. A handle-holder who requires concealment MUST NOT publish an _alter. record; alternative organs (the local alter-runtime daemon for local-only recognition, or a hardware-anchored device-organ quorum for device-local presence proof) support recognition without DNS publication. 15.2. DNS Query Metadata A resolver querying _alter.example.com reveals to its recursive resolver that it intends to verify the envelope hosted under that zone. Query metadata privacy is addressed at the transport layer: clients SHOULD prefer DoH ([RFC8484]) or DoT ([RFC7858]) over UDP/53 where operationally feasible. This consideration is identical to v01 / v02 and is repeated here for emphasis given the greater individual- identity sensitivity of the envelope surface. 15.3. Revocation Unlinkability The rev= field is the SHA-256 of a secret pre-image; publishing it does not disclose the pre-image. An observer cannot predict the pre- image or link it back to any identifier. Reveal at revocation time links the pre-image to the envelope, but only at the moment of revocation, not during the envelope's active lifetime. Morrison Expires 23 January 2027 [Page 48] Internet-Draft MCP DNS Discovery July 2026 16. IANA Considerations 16.1. Underscored DNS Node Name Registration This document requests IANA to update the entries in the "Underscored and Globally Scoped DNS Node Names" registry established by [RFC8552] as follows. Each label is defined by this document, in the section named, and no longer by an earlier revision of it. +=========+============+============================+ | RR Type | _NODE NAME | Reference | +=========+============+============================+ | TXT | _mcp | Section 5 of this document | +---------+------------+----------------------------+ | TXT | _org-alter | Section 6 of this document | +---------+------------+----------------------------+ | TXT | _alter | Section 7 of this document | +---------+------------+----------------------------+ Table 1 The _alter label is used to publish envelope records as defined in Section 7 of this document. Formal registration of _alter in the RFC 8552 registry is proposed on Standards Action maturation of this draft; during the Internet-Draft phase, the label operates under the provisional-use convention established by _dmarc, _mta-sts, _mcp (this draft), and _org-alter (this draft). 16.2. alter: URI Scheme Registration This document cross-references the provisional URI scheme registration of alter: per [RFC7595] Section 3. The full registration body is submitted to IANA separately. This document notes that recognition verifiers invoked via alter: URIs MUST follow Section 12.3 of this document for envelope verification. 16.3. Envelope Version Registry This document defines the version tag v=alter1 for the _alter. record, independent of the identically-named tag on the _org-alter. record. Future versions (v=alter2 and beyond) SHOULD be coordinated with the ALTER implementation community and documented in successor revisions of this draft. Until a formal IETF working group is chartered for identity- envelope DNS publication, the authors maintain the version namespace. Morrison Expires 23 January 2027 [Page 49] Internet-Draft MCP DNS Discovery July 2026 16.4. Org-Alter Version Registry (unchanged from v02) The version tag v=alter1 for the _org-alter. record is preserved from v02. No changes are requested in this revision. 16.5. Registry Namespace Registry (unchanged from v02) The initial set of entity field registry namespaces (abn, acn, ein, ch, cro, lei) defined in v02 is preserved unchanged. 16.6. Framework Token Registry (unchanged from v02) The initial set of regulated framework tokens (disp, itar, ear, hipaa, gdpr, soc2, iso27001, iso42001, essential8, aprs) defined in v02 is preserved unchanged. 16.7. Signature Algorithm Registry This document defines the initial pk= and sig= algorithm namespace ed25519 for the _alter. record. Future algorithms (e.g. ed448, ml-dsa-65) MAY be registered by successor documents. Resolvers MUST reject records whose algorithm prefix is not registered at the resolver's protocol version. 17. Examples This section provides non-normative examples of Envelope Records for common deployment scenarios. 17.1. Minimal Envelope for a Single Handle (NOT RECOMMENDED) A zone hosting a single Sovereign-tier handle publishes its envelope at _alter..: _alter.example.com. 3600 IN TXT ( "v=alter1; h=~alice; " "pk=ed25519:; " "ilr=; " "ts=1729123456; " "rev=; " "sig=" ) All base64url values in this example are illustrative. Production values are the Ed25519 public key, SHA-256 digests, and 64-byte detached signature encoded per [RFC4648] Section 5 without padding. Morrison Expires 23 January 2027 [Page 50] Internet-Draft MCP DNS Discovery July 2026 17.2. Zone Hosting Multiple Handles (a publisher MUST NOT do this) This example is retained so that a resolver can read the records a v04 publisher may already have published. It is NOT a pattern to follow. The shape below IS the enumeration exposure described in the Applicability statement. One query at the owner name returns every handle the zone hosts, and none of the individuals listed can consent on behalf of the others. A publisher MUST NOT create it (Section 7.1). Resolvers disambiguate by the h= field: _alter.example.org. 3600 IN TXT "v=alter1; h=~alice; pk=..." _alter.example.org. 3600 IN TXT "v=alter1; h=~bob; pk=..." _alter.example.org. 3600 IN TXT "v=alter1; h=~carol.bot; pk=..." A resolver asked to verify ~bob at example.org selects the second RR. 17.3. Full Zone (All Three Records; the _alter record is NOT RECOMMENDED) A zone operator running an org-alter instance for their own principal handle publishes all three records: _mcp.example.com. IN TXT "v=mcp1; url=https://mcp.example.com/" _org-alter.example.com. IN TXT "v=alter1; org=Example Org; ..." _alter.example.com. IN TXT "v=alter1; h=~alice; " "pk=ed25519:...; ilr=...; " "ts=...; rev=...; sig=..." _443._tcp.mcp.example.com. IN TLSA 3 1 1 Together these expose: the MCP service endpoint and its capabilities (_mcp); the legal entity, regulatory posture, and jurisdictional regions (_org-alter); the Sovereign-tier envelope for ~alice (_alter); and the DANE TLSA pin on the MCP endpoint. A resolver may consume any subset according to its recognition requirement. 17.4. Instrument-Tier Handle (NOT RECOMMENDED) An AI instrument handle uses the ~cc- prefix: _alter.example.com. 3600 IN TXT ( "v=alter1; h=~cc-example-model; " "pk=ed25519:...; ilr=...; ts=...; rev=...; sig=..." ) Morrison Expires 23 January 2027 [Page 51] Internet-Draft MCP DNS Discovery July 2026 Instrument-tier envelopes are bound to a specific model version. Rotation of the model version produces a new ~cc- handle with a new envelope; the prior envelope remains verifiable over its active lifetime and is revoked by the IdentityLog reveal path when the model is retired. 18. Interoperability with Earlier Record Generations A domain that publishes only a v01 _mcp. record continues to work with all v01, v02, and v03 clients. Where that record carries a transport value in proto, a client conforming to this revision reads it under rule 3 of Section 5.3.5 and reaches the same endpoint over the same transport. No republication is required for the record to keep working, and none is required for a record carrying a proto value that no revision recognised, because such a record was skipped by v01 clients and is skipped by these. A domain that publishes _mcp. and _org-alter. (v02) continues to work with v02 clients and with clients conforming to this document, unchanged. A client conforming to this document may additionally query _alter. and MUST handle its absence gracefully, which is the common case and the recommended one: publication of that record is NOT RECOMMENDED (Section 7.1.1), so a conforming client should expect to find it absent and MUST NOT treat its absence as an error. A domain that publishes all three records benefits from: * Service discovery via _mcp. (v01). * Organisational identity bootstrap via _org-alter. (v02). * Individual identity recognition via _alter. (v03). * DNSSEC-authenticated envelope delivery (Section 8). * DANE TLSA binding on the MCP endpoint (Section 9). A domain that publishes only _alter. (envelope-only, no MCP server, no organisational record) is permitted by the grammar. Revision 04 called it the appropriate configuration for a Sovereign- tier individual. That recommendation is WITHDRAWN, and the configuration is NOT RECOMMENDED per Section 7.1.1. Morrison Expires 23 January 2027 [Page 52] Internet-Draft MCP DNS Discovery July 2026 The three records are orthogonal along their semantic axes but share the zone's DNSSEC trust root. A resolver conforming to this document that resolves any subset of the three records treats each resolution as independent and does not fail the resolution of one record because another is absent or malformed. 19. Implementation Status This section records the status of known implementations at the time of publication, per [RFC7942]. This section was materially wrong in revision 04, which described a deployment that does not exist. It is rewritten here against the zone as it actually resolves and the code as it is actually written. What follows is deployed, and nothing else is claimed. Deployed and resolvable in the truealter.com zone: * _mcp.truealter.com, carrying v=mcp1 with url, proto, pk, epoch, and cap. This is the only record in the zone that a resolver can verify against this document today. * _alter.truealter.com, carrying v=alter1. It does not carry the envelope field set (h, ilr, ts, rev, sig) and is therefore NOT an instance of the Envelope Record of Section 7. No conformant Envelope Record is published in this zone. Implemented in code, and NOT exercised against any conformant envelope, because none is published: * A resolver and verification library implementing the JCS signing- input construction of Section 7.4 and the Ed25519 signature check. It conforms to this revision on the signing input and the signature check. It does NOT conform on two steps of the recognition procedure of Section 12.3: it still treats the IdentityLog cross-reference as fatal, where step 9 now says a resolver MUST NOT abort, and it still fetches caveats over HTTPS, which step 11 now places out of scope. Those two steps follow revision 04, and this document does not claim otherwise. NOT deployed, and stated plainly because revision 04 claimed otherwise: * _org-alter.truealter.com does not resolve. NXDOMAIN. * _443._tcp.mcp.truealter.com does not resolve, so no DANE TLSA pin is published and the DANE binding of Section 9 is untested in deployment. Morrison Expires 23 January 2027 [Page 53] Internet-Draft MCP DNS Discovery July 2026 * truealter.com is NOT DNSSEC-signed. It publishes no DNSKEY and the parent zone holds no DS. Section 8 of this document is a MUST, and the operator does not yet meet it. No Envelope Record can be relied upon in this zone until it does. * There is no signed-tree-head federation and no witness-mirror network. Revision 04 described four independent witness surfaces including an on-chain anchor contract. None of them exist. * No inclusion proof is generated or checked anywhere. The ilr field of Section 7.2 is published as a bare root with no proof attached. Section 14.3 sets out what that permits. The Envelope Record of Section 7 therefore has NO conformant deployment at the time of writing, in this zone or any other known to the author. It is specified, implemented in a verifier, and unpublished. The deployed _alter.truealter.com record carries none of the envelope fields that Section 7 defines, so it is not an instance of the Envelope Record and a resolver MUST NOT treat it as one. 20. References 20.1. Normative References [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, DOI 10.17487/RFC4033, March 2005, . [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, DOI 10.17487/RFC4034, March 2005, . Morrison Expires 23 January 2027 [Page 54] Internet-Draft MCP DNS Discovery July 2026 [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Protocol Modifications for the DNS Security Extensions", RFC 4035, DOI 10.17487/RFC4035, March 2005, . [RFC4343] Eastlake 3rd, D., "Domain Name System (DNS) Case Insensitivity Clarification", RFC 4343, DOI 10.17487/RFC4343, January 2006, . [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006, . [RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, DOI 10.17487/RFC5234, January 2008, . [RFC6698] Hoffman, P. and J. Schlyter, "The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA", RFC 6698, DOI 10.17487/RFC6698, August 2012, . [RFC7208] Kitterman, S., "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1", RFC 7208, DOI 10.17487/RFC7208, April 2014, . [RFC7595] Thaler, D., Ed., Hansen, T., and T. Hardie, "Guidelines and Registration Procedures for URI Schemes", BCP 35, RFC 7595, DOI 10.17487/RFC7595, June 2015, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8461] Margolis, D., Risher, M., Ramakrishnan, B., Brotman, A., and J. Jones, "SMTP MTA Strict Transport Security (MTA- STS)", RFC 8461, DOI 10.17487/RFC8461, September 2018, . [RFC8552] Crocker, D., "Scoped Interpretation of DNS Resource Records through "Underscored" Naming of Attribute Leaves", BCP 222, RFC 8552, DOI 10.17487/RFC8552, March 2019, . Morrison Expires 23 January 2027 [Page 55] Internet-Draft MCP DNS Discovery July 2026 [RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, DOI 10.17487/RFC8785, June 2020, . [RFC9421] Backman, A., Ed., Richer, J., Ed., and M. Sporny, "HTTP Message Signatures", RFC 9421, DOI 10.17487/RFC9421, February 2024, . [RFC9460] Schwartz, B., Bishop, M., and E. Nygren, "Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records)", RFC 9460, DOI 10.17487/RFC9460, November 2023, . [MCP] Agentic AI Foundation, "Model Context Protocol Specification", 2026, . 20.2. Informative References [AGENT-AID] Nemethi, B., "Agent Identity and Discovery (AID)", 2026, . [DNS-AID] Mozley, J., Williams, N., Sarikaya, B., Schott, R., and J. Damick, "DNS for AI Discovery", 2026, . [MDNS-AGENT] Jakab, L. and F. Brockners, "Zero-Configuration Agent Discovery", 2026, . [MDNS-ARCHITECT] Yao, J., Geng, G., Chen, M., and H. Li, "Agent Discovery Architecture", 2026, . [SAIP] Jovancevic, S., "SAIP: Signed Agent Identity Protocol", 2026, . Morrison Expires 23 January 2027 [Page 56] Internet-Draft MCP DNS Discovery July 2026 [DNSDISC-01] Morrison, B., "Discovery of Model Context Protocol Servers via DNS TXT Records", Work in Progress, Internet-Draft, draft-morrison-mcp-dns-discovery-01, April 2026, . [DNSDISC-02] Morrison, B., "Discovery of Model Context Protocol Servers via DNS TXT Records", Work in Progress, Internet-Draft, draft-morrison-mcp-dns-discovery-02, April 2026, . [RFC2606] Eastlake 3rd, D. and A. Panitz, "Reserved Top Level DNS Names", BCP 32, RFC 2606, DOI 10.17487/RFC2606, June 1999, . [RFC6376] Crocker, D., Ed., Hansen, T., Ed., and M. Kucherawy, Ed., "DomainKeys Identified Mail (DKIM) Signatures", STD 76, RFC 6376, DOI 10.17487/RFC6376, September 2011, . [RFC6781] Kolkman, O., Mekking, W., and R. Gieben, "DNSSEC Operational Practices, Version 2", RFC 6781, DOI 10.17487/RFC6781, December 2012, . [RFC9989] Herr, T., Ed. and J. Levine, Ed., "Domain-Based Message Authentication, Reporting, and Conformance (DMARC)", RFC 9989, DOI 10.17487/RFC9989, May 2026, . [RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, . [RFC7942] Sheffer, Y. and A. Farrel, "Improving Awareness of Running Code: The Implementation Status Section", BCP 205, RFC 7942, DOI 10.17487/RFC7942, July 2016, . [RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, . Morrison Expires 23 January 2027 [Page 57] Internet-Draft MCP DNS Discovery July 2026 [SEP-1649] "MCP Server Cards", n.d., . [SEP-1960] ".well-known/mcp Discovery Endpoint", n.d., . [MORRISON-IFT] Morrison, B., "Identity Field Theory: Toward a Physics of Being Known", 2026, . Appendix A. Recognition Pseudocode The following pseudocode illustrates the combined recognition procedure defined in Section 12.3. It is non-normative; the normative procedure is the twelve-step algorithm in the body of this document. function recognise_envelope(handle, zone): # Step 1-2: Query + DNSSEC response = dns_query("_alter." + zone, type=TXT, prefer=DoH) if not response.ad_bit and not local_rrsig_validate(response): raise UnauthenticatedResponse # Step 3-5: Chunk reassembly + handle disambiguation + fields records = [parse_alter_record(rr) for rr in response.rrset] record = find(records, lambda r: r.h == handle) if record is None or record.v != "alter1": raise RecordNotFound for f in ["h", "pk", "ilr", "ts", "rev", "sig"]: if not hasattr(record, f): raise MalformedRecord # Step 6-7: Envelope reconstruction + JCS. Keys are the TXT # field names; every value stays a string, ts included. alg = signature_alg_for_prefix(record.pk) # Signature Algorithm # Registry envelope = { "v": record.v, "h": record.h, "pk": record.pk, "ilr": record.ilr, "ts": record.ts, "rev": record.rev, "caveats": [], "signature_alg": alg, Morrison Expires 23 January 2027 [Page 58] Internet-Draft MCP DNS Discovery July 2026 } signing_input = jcs_canonicalise(envelope) # Step 8: signature verify under the derived algorithm if not signature_verify(alg, record.pk, record.sig, signing_input): raise SignatureInvalid # Step 9: IdentityLog cross-ref. ADVISORY. Confirms the ROOT # was published; cannot confirm THIS envelope is under that # root, so a failure annotates and never aborts. See 12.3. ilr_root_seen = identitylog_root_published(record.ilr) # Step 10: DANE TLSA (if establishing MCP session) if establishing_mcp_session(zone): tlsa = dns_query("_443._tcp.mcp." + zone, type=TLSA) if not tlsa_matches_endpoint(tlsa, "mcp." + zone): raise TLSAFailure # Step 11: Caveats are OUT OF SCOPE for this document (Sec 10.3). # No transport and no vocabulary are specified, so the verified # envelope carries none and the signature is checked over []. caveats = [] # Step 12: Revocation if identitylog_revocation_revealed(record.rev): raise EnvelopeRevoked return VerifiedEnvelope(record, caveats, ilr_root_seen) Appendix B. Document History draft-morrison-mcp-dns-discovery-05 (July 2026): Corrections to defects in -04, and the completion of a document that had been claiming for two revisions to stand on its own while deferring half of itself to documents it cited by the wrong section number. No new mechanism is introduced in this revision. * Restores the citation of [AGENT-AID], which revision 01 carried and revisions 02 through 04 lost. It is the closest neighbour to the _mcp record and it published its shape first, and a reader of both documents should be told so by this one. Section 3 also distinguishes it from [DNS-AID], a different draft with the same acronym, and states how the two compose: [AGENT-AID] is intentionally small and defers to protocol-specific mechanisms after discovery, and this document is what its mcp protocol token defers to. Morrison Expires 23 January 2027 [Page 59] Internet-Draft MCP DNS Discovery July 2026 * Makes the stand-alone claim true. All three record formats are now given in full (Section 5, Section 6, Section 7), as are all three procedures (Section 12.1, Section 12.2, Section 12.3) and the caching rules (Section 13). Revisions 03 and 04 incorporated the first two records and their procedures by reference to revisions 01 and 02. Nothing is incorporated by reference now, and no reader of this document needs to fetch another one in the series. * Separates the agent protocol family from the transport binding in the _mcp record. Revision 01 used proto for the transport. proto now names the protocol family, transport names the binding, and transport is the term because the Model Context Protocol specification already calls this axis by that name. The alignment is with the neighbouring DNS agent-discovery drafts (Section 3), so an implementer reading two of them does not have to hold two meanings for one key. * States how to read an _mcp record published under revision 01 (Section 5.3.5), including the case revision 01 left unusable. A proto value that names neither the protocol family nor a known transport causes the record to be SKIPPED, exactly as revision 01 required, and is NOT read as a protocol family with the default transport applied. Widening the rule would newly accept records no client could ever use. * Reconciles the _mcp grammar with its prose. The grammar admits any token in proto and transport, because a resolver must parse a revision 01 record before it can decide what to do with it. Syntactic admissibility is not definition. proto has exactly one defined value and transport exactly three, the two sets are disjoint, and so the claim that no value is defined for both fields is now true, where in earlier drafting it was not. * Corrects a grammar defect inherited from revision 02. The _org- alter record defined org, entity and entity-type over 1*VCHAR, which excludes the space, so the grammar could not derive the values revision 02's own examples published. A text-value rule admitting SP, and excluding only the field separator, replaces it (Section 6.2). This is the first revision to carry that format as its own normative text, so it is the first that had to be able to derive its own examples. * Stops every value rule in all three grammars from running past the end of its own field. unknown-field and https-uri were defined over *VCHAR, and VCHAR includes the semicolon, so a single field could derive the whole rest of the record and consume the fields after it. Two character classes replace it, because the two kinds Morrison Expires 23 January 2027 [Page 60] Internet-Draft MCP DNS Discovery July 2026 of value have different needs: qtext admits SP and excludes the semicolon, for a human-readable name; uri-char excludes both, for a URI, which carries no raw space and would otherwise run past its own end. A class that is right for a name is not thereby right for a URI. * States the exclusion that ABNF cannot express (Section 5.2). unknown-field matches only a field name this document does not define, so a defined field whose value is malformed is a malformed record and MUST be discarded, never re-read as an unknown field. Without the rule the alternation swallows every defect it exists to exclude, because token matches a defined name as readily as an undefined one. The split-on-semicolon parse in Section 12.1 already behaved this way, so no implementation changes; the grammar now says what the parser was always doing. * Requires a publisher emitting transport to emit proto=mcp with it (Section 5.3.5). A revision 01 client ignores the transport field it does not know and reads proto, so transport=streamable-http; proto=sse was one record that resolved to two different transports depending on which revision read it. * Adds Section 3 and Section 4, which situate this document against [DNS-AID], [MDNS-AGENT], [MDNS-ARCHITECT], and [SAIP], and say why the payload here is carried in TXT rather than SVCB. * Corrects the IANA registry table (Section 16.1), which cited the three labels to sections of revisions 01, 02 and 03, by numbers that were wrong in any case. Each label is now cited to the section of this document that defines it. * Rewrites Section 19 (Implementation Status). The -04 section was false on four counts. It claimed an _org-alter record that does not resolve, a DANE TLSA pin that does not resolve, an envelope record exercising the Section 7 field set where the deployed record carries none of those fields, and a four-surface signed- tree-head witness federation, including an on-chain anchor contract, none of which exists. The section now states only what is deployed, and states plainly what is not. * Corrects Section 14.3 defence (1). The -04 text claimed that ilr= defeats envelope substitution. It does not. ilr= is a bare root with no inclusion proof, so a forged envelope naming any genuinely witnessed root passes every specified check. The false claim is withdrawn and the limit is stated. Morrison Expires 23 January 2027 [Page 61] Internet-Draft MCP DNS Discovery July 2026 * Fixes the signing input of Section 7.4, which no third party could have interoperated with. The keys are now the TXT field names, v is inside the signed object, and ts is a JSON string of the wire digits rather than a JSON number. The construction is now normative and exhaustive. * Derives signature_alg from the pk= algorithm prefix via the registry of Section 16.7, rather than injecting Ed25519 as an implicit constant into the signed bytes. Taken alone this change is byte-compatible, because for pk=ed25519: the derivation yields the string the constant supplied. The revision as a whole is NOT byte-compatible: the signing-input repair above changes the signed bytes deliberately, so an envelope signed under -04 does not verify under -05. No envelope signed under -04 exists. * Relaxes the multi-string rule of Section 7.6, which prohibited splitting within a key-value pair and thereby made any field longer than 255 octets unrepresentable in a TXT record. Resolvers already concatenate before parsing, so the prohibition bought nothing and cost the ability to carry a large signature at all. * Marks publication of a per-individual envelope in DNS as NOT RECOMMENDED (Section 7.1.1). A zone MUST NOT publish envelopes for more than one handle at one owner name, because a single query there returns the whole set, which is a membership roll that no one listed in it can consent to on behalf of the others. The envelope format, its signing input and its verification procedure are not implicated. * Withdraws the IdentityLog witness federation, everywhere it was asserted. Revision 04 defined it in the terminology, required it normatively in Section 7.3.4 and Section 10, made it fatal at step 9 of the recognition procedure, and named four witness surfaces including an on-chain anchor contract. None of those surfaces exist. The ilr= field is retained, so the wire format does not break, but the cross-reference is now advisory and the document states plainly what the field can and cannot establish. * States, rather than papers over, the fact that a reader implementing from this document alone cannot check revocation. The surface that carries reveals is not specified here and is not published anywhere fetchable. * Repairs every internal cross-reference, and repairs the class rather than the instances. The -04 prose was written against an older section numbering and never renumbered, so a reader following a pointer to the Envelope Record landed on the DNSSEC section. Every reference to a section of this document is now a Morrison Expires 23 January 2027 [Page 62] Internet-Draft MCP DNS Discovery July 2026 symbolic anchor that cannot go stale under renumbering. The only literal section numbers that remain in the prose point into other documents. * Corrects all four references into [DNSDISC-01] and [DNSDISC-02]. Every one of them named the wrong section. The _mcp record format is Section 5 of [DNSDISC-01] and was cited as Section 3; its discovery procedure is Section 6 and was cited as Section 4. The _org-alter record format is Section 6 of [DNSDISC-02] and was cited as Section 4; its bootstrap procedure is Section 7 and was cited as Section 6. A reader who followed any of them arrived at the wrong section of the right document. * Restates the discovery procedure (Section 12.1), the identity bootstrap procedure (Section 12.2), and the caching rules for both records (Section 13) in full. Revisions 03 and 04 claimed to stand alone while deferring three procedures to documents they cited incorrectly. The record formats are restated in full as well, so nothing at all is now incorporated by reference, and both earlier revisions carry a reference entry, which neither had. * Gives the _alter record two ABNF grammars (Section 7.2), one for publisher emission and one for resolver acceptance. Revision 04 gave the publisher grammar alone, then required resolvers to accept orderings that grammar cannot derive. The field- cardinality rule, which ABNF cannot express, is stated normatively beside it, and the v-first rule is reconciled with the ordering freedom rather than contradicting it. * Reconciles Section 14.6 with step 5 of Section 12.2. Revision 04 said the _mcp and _org-alter keys MAY differ, while the bootstrap procedure it incorporated by reference required them to MATCH and required a wizard to refuse on mismatch. The bootstrap rule stands. The envelope key of Section 7 is the key that is genuinely distinct, and it alone MAY differ from the other two. * Removes two hand-written reference sections that duplicated the generated ones and cited five documents with no reference entry. * Corrects the field count throughout. Seven fields are REQUIRED; the -04 prose said five in three places. draft-morrison-mcp-dns-discovery-03 (April 2026): Editorial corrections (retiring -02): Morrison Expires 23 January 2027 [Page 63] Internet-Draft MCP DNS Discovery July 2026 * Removes the third-party-domain worked example used in -02 and replaces all instances with [RFC2606] reserved example-domain forms; no third-party operational domain appears in any illustrative DNS record in this revision. * Strips city and locality fields from the author front-matter block, retaining only name, organisation, and email per editorial policy. Substantive additions: * Adds the _alter. Envelope Record (Section 7). * Defines v, h, pk, ilr, ts, rev, sig fields for the new record. * Introduces a mandatory DNSSEC validation requirement for _alter. responses (Section 8). * Introduces a mandatory DANE TLSA [RFC6698] pin on the MCP endpoint (Section 9) for envelope-triggered MCP sessions. * Adds the IdentityLog cross-reference requirement (Section 10). Revision 05 withdraws it; see the -05 entry above. * Adds a provisional alter: URI scheme cross-reference per [RFC7595] (Section 11). * Adds the envelope recognition procedure (Section 12.3), a twelve- step algorithm. * Adds IANA registration for _alter underscore-prefixed label (Section 16.1) and the independent v=alter1 envelope version namespace. * Adds a Signature Algorithm Registry (Section 16.7) with initial value ed25519. * Adds Security Considerations for DNSSEC downgrade, TLSA pin rotation, envelope substitution, revocation opacity, clock skew, cross-record key consistency, and passive-stream coupling. * Adds Privacy Considerations for public handle disclosure, DNS query metadata, and revocation unlinkability. * Adds Examples for minimal envelope, multi-handle zone, full ALTER zone with all three records, and Instrument-tier handle. Morrison Expires 23 January 2027 [Page 64] Internet-Draft MCP DNS Discovery July 2026 * Adds Implementation Status entry for the envelope reference implementation. * Incorporated the v01 _mcp. and v02 _org-alter. record specifications by reference, leaving them unchanged. Revision 05 restates both in full; see the -05 entry above. draft-morrison-mcp-dns-discovery-02 (April 2026): * Adds the _org-alter. Org-Identity Record. * Defines org, entity, entity-type, founded, regions, regulated, bootstrap, mcp-policy, epoch, pk, attest, ext fields for the organisational record. * Adds the Identity Bootstrap procedure. * Adds IANA registration for _org-alter underscore-prefixed label. * Adds version tag v=alter1 (org-alter namespace) and registry namespace and framework token registries. * Adds Examples for minimal, full, regulated (DISP), and multi- regulator deployments. * Adds Implementation Status entry for the orgalter_discover reference library. * v01 _mcp. record specification is incorporated by reference and remains unchanged. draft-morrison-mcp-dns-discovery-01 (April 2026): * Adds Identity Field Theory grounding for epoch and scope. * Refines security considerations for identity assurance decay. * Refines privacy considerations for scope as a privacy boundary. * Adds Coexistence section with SEP-1959, AID, A2A. * Adds Implementation Status section. draft-morrison-mcp-dns-discovery-00 (April 2026): * Initial submission. * Defines _mcp. TXT record format with ABNF grammar. Morrison Expires 23 January 2027 [Page 65] Internet-Draft MCP DNS Discovery July 2026 * Defines discovery procedure with HTTPS fallback. * Defines pk, epoch, attest, scope, cap, priority, ttl, and ext fields. * Registers _mcp in the underscored DNS node name registry. Contributors Christopher Whiteside Email: cwhiteside.engineering@gmail.com Author's Address Blake Morrison Alter Meridian Pty Ltd Email: blake@truealter.com Morrison Expires 23 January 2027 [Page 66]