blog
Notes, writeups, and failure modes.
The Human Foundation of Open Protocols — Notes From the Domain Summit Keynote
My first keynote, in Berlin: why standards outlive the people who write them, the three schools of thought forming around agentic identity, where domains actually fit, and why the question of who mediates the agentic web is being answered right now.
read →
Agentic Workloads on an Infoblox NIOS-XaaS POP
Bypassing agent registries to individually advertise agentic workloads on existing infrastructure.
read →
ICANN's Universal Acceptance From the Receiving End: Three Internationalized Domain Names
I registered three internationalized domains and tried to make them serve web pages and receive mail on a free stack. DNS did its job every time.
read →
Agent Identity Without a New Authority — Digital Wallets and the SAN
Republic of Korea's OpenDID and France's mDL ship a TPM-anchored credential flow. DNS-AID and ANS can ride that substrate without inventing a new registry, central root, or hardware-wallet assumption with some tinkering.
read →
Over-Engineering Homelab Syslog Receiving With DNSTAP
Changing per-query DNS telemetry from syslog forwarding to a DNSTAP pipeline, and what the syslog path actually does on the appliance.
read →
Auditing the Agent Internet — Agents Grading Agents
A read-only auditor for the open agent web. It walks any domain's substrate — DNS-AID, AgentFinder, AI-Catalog, DID Web, TLSA, DNSSEC — and provides a grade based on ease of other agents finding and interacting with it.
read →
Bookings Goes Real — Cloudflare Workers, Claude Managed Agents, and DNS-AID Glue
The first of the five fake agents now answers real requests. Three protocol surfaces, one Anthropic-managed Claude underneath, and DNS-AID + ANS attesting to all of it end-to-end.
read →
AgentFinder — Federation, Semantic Search, and the DNS Gesture
AgentFinder adds representativeQueries and a /search federation API on top of ai-catalog. Its DNS-SVCB gesture is exactly what DNS-AID specifies. They should know about each other.
read →
Wiring the CTEM Spiderweb
A pipeline that unifies Infoblox CTEM, lookalike-domain monitoring, brand protection, and open-source attack-surface signals into one Graylog dashboard — keyed by finding name, deduped across sources, and tagged with bug-bounty eligibility.
read →
ai-catalog — One URL, Many Protocols
A single /.well-known/ai-catalog.json enumerates every protocol surface an agent exposes — A2A, MCP, HTTPS — under one endpoint. The wrapping is the load-bearing idea.
read →
The Thing the Index Points To
DNS-AID's path-2 index leaf names a registry the draft explicitly leaves out of scope. Wiring ANS — a registration authority plus transparency log — to be that registry.
read →
Five Fake Agents on a Real Cloudflare Zone
Publishing 5 DNS-AID agent records to darknetian.com — flat primary plus walkable AliasMode, DANE TLSA from throwaway self-signed certs, all DNSSEC-signed end-to-end. No agents actually exist behind any of them.
read →
Agent Cards — The Well-Known JSON
agent-card.github.io standardizes how an agent describes itself at /.well-known/. DNS-AID resolves names; agent cards describe what answers at those names.
read →![Rendering of a /.well-known/agent-card/bookings.json document in neon-on-dark monospace, showing the load-bearing fields — id, provider, description, an interfaces[] array of three protocol entries (a2a, mcp, https), capabilities, securitySchemes, version — laid out like an ASCII-art card](/img/248ydW27qc-480.jpeg)
EDNS(0) for Agent Discovery — Letting the Client Tell the Resolver What It's Looking For
An experimental EDNS(0) option for DNS-AID that lets a client signal selector filters on the query so any hint-aware hop can narrow the answer or short-circuit with a cached match.
read →
REEF — When the Agent Holds the Pen
An agent loop that reads, reasons, and (with your permission) edits Infoblox Threat Defense policy. Runs against any LLM you point it at — including a 4GB GPU in your homelab.
read →
DCV — Proving an Agent Belongs to a Domain Without a Central Authority
A stateless challenge/response primitive over TXT records that lets a NAT'd agent prove zone control without registering with anyone.
read →
Graylog Enrichment, Deepened
Adding MAC→DHCP-hostname lookups, dashboards-as-code, and the long tail of NIOS WAPI and OpenSearch quirks the first pass left behind.
read →
Creating a New DNS Resource Record Type
Why it may be beneficial to think about DNS in a new way.
read →
Zombie Data Came Back to Life to Kill Me 🧟♂️
Implications of poor automation cleanup hygiene.
read →
Help! Use Forwarders Only Caused My Outage
Implications of improperly-scoped security policies.
read →
Encrypted DNS Server Redirection
Discussing the merits of IETF internet draft EDSR.
read →
Adding Observability to the Homelab
Adding Grafana and Prometheus for SNMP data.
read →
Enriching Graylog with Infoblox
Utilizing an IPAM source to enhance SIEM correlation.
read →
Graylog for Infoblox
Creating a reporting source for Infoblox with Graylog.
read →
Graylog for Homelab (on Ubuntu 24.04 LTS)
Creating a log indexing source with Graylog and Ubuntu 24.04 in 2026.
read →
Zero Trust Overlays
Comparison of Zero Trust documents from a US policy perspective.
read →
Build This Website
Notes and lessons learned in deploying darknetian.com.
read →