Publish DNS-AID discovery records for rewrites.bio

.github/workflows/publish-dns-aid.yml

@@ -0,0 +1,35 @@
+name: Publish DNS-AID records
+
+on:
+  workflow_dispatch:
+    inputs:
+      command:
+        description: "publish-dns-aid.sh command"
+        required: true
+        default: publish
+        type: choice
+        options:
+          - publish
+          - verify
+          - dnssec
+
+permissions:
+  contents: read
+
+jobs:
+  dns-aid:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Run DNS-AID script
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
+          DNS_AID_DOMAIN: rewrites.bio
+        run: |
+          chmod +x scripts/publish-dns-aid.sh
+          ./scripts/publish-dns-aid.sh "${{ github.event.inputs.command }}"

README.md

@@ -34,6 +34,10 @@ All manifesto content lives in the Astro source files (`src/pages/index.astro` a
 
 Configured for Netlify (see `netlify.toml`). Push to `main` to deploy.
 
+## DNS for AI Discovery (DNS-AID)
+
+Agent discovery via DNS requires SVCB/HTTPS records under `_agents.rewrites.bio` plus DNSSEC. Netlify DNS does not support those record types — see [`dns/README.md`](dns/README.md) and run `./scripts/publish-dns-aid.sh` with Cloudflare (or delegate `_agents.rewrites.bio` to a provider that supports SVCB).
+
 ## License
 
 Open source under the [MIT License](LICENSE).

dns/README.md

@@ -0,0 +1,86 @@
+# DNS for AI Discovery (DNS-AID)
+
+Publish [DNS-AID](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/) records so agents can discover rewrites.bio endpoints through DNS before any HTTP request.
+
+## Why this is not only a site change
+
+DNS-AID records are **authoritative DNS data**, not files served by the Astro site. The isitagentready scanner queries:
+
+- `SVCB` / `HTTPS` `_index._agents.rewrites.bio`
+- `SVCB` / `HTTPS` `_a2a._agents.rewrites.bio`
+- `SVCB` / `HTTPS` `_mcp._agents.rewrites.bio`
+
+Each record must be in **ServiceMode** (`priority >= 1`) with at least `alpn` and `port`, and the zone must be **DNSSEC-signed** for `checks.discoverability.dnsAid` to pass.
+
+## Netlify DNS limitation
+
+rewrites.bio uses **Netlify DNS** (NS1 under the hood). Netlify's DNS UI and API only support A, AAAA, CNAME, MX, NS, TXT, and related types — **not SVCB or HTTPS** (RFC 9460).
+
+Choose one of the paths below.
+
+## Option A — Cloudflare DNS for rewrites.bio (recommended)
+
+1. Add `rewrites.bio` to Cloudflare and point registrar nameservers to Cloudflare.
+2. Recreate existing Netlify DNS records in Cloudflare (A/ALIAS/CNAME for the site, etc.).
+3. Publish DNS-AID records:
+
+```sh
+export CLOUDFLARE_API_TOKEN="..."   # Zone.DNS Edit + Zone.DNS Settings
+export CLOUDFLARE_ZONE_ID="..."
+./scripts/publish-dns-aid.sh publish
+./scripts/publish-dns-aid.sh dnssec
+```
+
+4. If the registrar is not Cloudflare, add the DS records printed by `dnssec`.
+5. Verify:
+
+```sh
+./scripts/publish-dns-aid.sh verify
+```
+
+## Option B — Delegate only `_agents.rewrites.bio`
+
+Keep Netlify DNS for the apex zone and delegate the `_agents` label to a provider with SVCB/HTTPS support (Cloudflare, Route 53, NS1, deSEC, etc.).
+
+1. Create a child zone for `_agents.rewrites.bio` at the provider.
+2. Delegate from Netlify:
+
+```sh
+export NETLIFY_AUTH_TOKEN="..."
+export DELEGATE_NS="ada.ns.cloudflare.com bob.ns.cloudflare.com"  # example
+./scripts/publish-dns-aid.sh delegate
+```
+
+3. In the **child zone**, publish records named `_index`, `_mcp`, and `_a2a` (see `dns/records.json`).
+4. Enable DNSSEC on the child zone and add the resulting **DS** record in Netlify DNS for `_agents.rewrites.bio`.
+5. Run `./scripts/publish-dns-aid.sh verify`.
+
+## Record definitions
+
+Canonical machine-readable config: [`dns/records.json`](records.json)
+
+Zone-file style (for manual import):
+
+```sh
+./scripts/publish-dns-aid.sh show
+```
+
+Human-readable reference: [`netlify/dns-aid-records.example`](../netlify/dns-aid-records.example)
+
+## GitHub Actions
+
+Workflow [`.github/workflows/publish-dns-aid.yml`](../.github/workflows/publish-dns-aid.yml) can publish records when these repository secrets are set:
+
+| Secret                 | Purpose                                            |
+| ---------------------- | -------------------------------------------------- |
+| `CLOUDFLARE_API_TOKEN` | Cloudflare API token                               |
+| `CLOUDFLARE_ZONE_ID`   | Zone ID for `rewrites.bio` or delegated child zone |
+
+Trigger manually via **Actions → Publish DNS-AID records → Run workflow**.
+
+## References
+
+- [DNS-AID skill](https://isitagentready.com/.well-known/agent-skills/dns-aid/SKILL.md)
+- [DNS-AID draft](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/)
+- [RFC 9460 (SVCB/HTTPS)](https://www.rfc-editor.org/rfc/rfc9460)
+- [Agent readiness spec — DNS-AID](https://specification.website/spec/agent-readiness/dns-aid/)

dns/records.json

@@ -0,0 +1,31 @@
+{
+  "domain": "rewrites.bio",
+  "target": "rewrites.bio.",
+  "ttl": 3600,
+  "records": [
+    {
+      "name": "_index._agents",
+      "type": "HTTPS",
+      "priority": 1,
+      "target": "rewrites.bio.",
+      "params": "alpn=\"h3,h2\" port=443 mandatory=alpn,port",
+      "description": "Site index and discovery entrypoint"
+    },
+    {
+      "name": "_mcp._agents",
+      "type": "HTTPS",
+      "priority": 1,
+      "target": "rewrites.bio.",
+      "params": "alpn=\"h3,h2\" port=443 mandatory=alpn,port",
+      "description": "WebMCP tools and MCP server card on the homepage"
+    },
+    {
+      "name": "_a2a._agents",
+      "type": "SVCB",
+      "priority": 1,
+      "target": "rewrites.bio.",
+      "params": "alpn=\"h3,h2\" port=443 mandatory=alpn,port key65000=\"/.well-known/agent.md\"",
+      "description": "Agent-to-agent discovery via public content endpoints"
+    }
+  ]
+}

netlify/dns-aid-records.example

@@ -1,8 +1,13 @@
 ; DNS for AI Discovery (DNS-AID) records for rewrites.bio
-; Add these at your DNS provider and sign the zone with DNSSEC.
+; Generated reference — canonical source: dns/records.json
+; Netlify DNS does not support SVCB/HTTPS; use Cloudflare or delegate _agents.rewrites.bio.
+; Sign the zone with DNSSEC so validating resolvers return authenticated data.
 ;
 ; _index._agents — site index and discovery entrypoint
 _index._agents.rewrites.bio. 3600 IN HTTPS 1 rewrites.bio. alpn="h3,h2" port=443 mandatory=alpn,port
 
-; _a2a._agents — agent-to-agent discovery (content endpoints, no auth)
+; _mcp._agents — WebMCP tools and MCP server card on the homepage
+_mcp._agents.rewrites.bio. 3600 IN HTTPS 1 rewrites.bio. alpn="h3,h2" port=443 mandatory=alpn,port
+
+; _a2a._agents — agent-to-agent discovery (public content endpoints)
 _a2a._agents.rewrites.bio. 3600 IN SVCB 1 rewrites.bio. alpn="h3,h2" port=443 mandatory=alpn,port key65000="/.well-known/agent.md"