# Agent Name Service v2 (ANS) ANS

[2 · Identify](/category/identify/)

| Agent Name Service v2 (ANS) |
| --- |
| Category | [Identify](/category/identify/) |
| Governed by | IETF Independent Submission (individual draft; not sponsored by a chartered WG); replaces the authors' earlier draft-narajala-ans |
| Status | Active Internet-Draft, Intended Status: Informational |
| Phase | draft |
| Implementation | none found |
| Adoption | unmeasured |
| Version | draft-narajala-courtney-ansv2-01, last updated 2026-04-15 (replaces draft-narajala-ans, first published 2025-05) (2026-04-15) |
| Specification | [https://datatracker.ietf.org/doc/draft-narajala-courtney-ansv2/](https://datatracker.ietf.org/doc/draft-narajala-courtney-ansv2/) |
| Found at | none |
| Last checked | 2026-09-06 |

[Identify](/category/identify/) Agent Name Service v2 (ANS) is a proposed identity architecture that anchors every autonomous agent's identity to a DNS domain name it controls, rather than to a platform-specific account or an unverified self-asserted name [[1]](#ref-1). A Registration Authority (RA) verifies domain ownership via the ACME protocol (the same mechanism Let's Encrypt uses for TLS certificates) and then issues two certificates: a Server Certificate from a public Certificate Authority, and an Identity Certificate from a private CA binding a version-specific "ANSName" to that domain [[1]](#ref-1). Every lifecycle event (issuance, rotation, revocation) is sealed into an append-only Transparency Log aligned with the IETF's SCITT (Supply Chain Integrity, Transparency, and Trust) work, and clients can pick from three assurance tiers — Bronze (PKI only), Silver (PKI plus DANE), or Gold (PKI plus DANE plus the Transparency Log) — matched to how much a given transaction has at risk [[1]](#ref-1).

## Overview
It solves domain-anchored, auditable agent identity where the party relying on the identity did not provision it. Its design explicitly decouples identity issuance (owned by the RA) from discovery (left to independent, competing Discovery Services that index the sealed events), and separates a three-layer trust model: Layer 1 foundational identity (this protocol), Layer 2 operational-maturity attestation by third-party assessors, and Layer 3 real-time behavioral reputation scoring — only Layer 1 is specified here [[1]](#ref-1). It does not itself define reputation scoring, message formats for agent-to-agent communication, or any fixed DNS record type or well-known HTTP path we could locate in the text reviewed; those remain open or left to Discovery Services.

Current state: an Independent Submission Internet-Draft — not sponsored by any IETF working group — first published as draft-narajala-ans in May 2025 and renamed/rewritten as draft-narajala-courtney-ansv2, currently at revision -01 (last updated 2026-04-15) [[1]](#ref-1). Authors span GoDaddy, OWASP, and Cisco.

Who implements it: no running implementation, reference code, or deployed Registration Authority was found in this pass. GoDaddy and Infoblox issued a joint press release in May 2026 announcing support for open standards for AI-agent discovery, identity and verification, but this is a statement of intent about the space rather than confirmed evidence that ANS v2 specifically is deployed [[2]](#ref-2).

Disputed or unknown: whether GoDaddy's announced support is for this exact spec version; whether any Registration Authority or Discovery Service exists yet; and how the fixed discovery mechanics (DNS record type, well-known path) will be finalized are all open.

## Discovery and probe

A Registration Authority verifies domain ownership via ACME and issues a dual certificate (public-CA Server Certificate + private-CA Identity Certificate binding a version-specific ANSName); lifecycle events are sealed into an append-only SCITT-aligned Transparency Log · none

```
GET n/a — no fixed well-known path or DNS record type is defined in the draft text reviewed
parse:     Resolve the ANSName's Identity Certificate chain and check the Transparency Log for a matching sealed registration event
on absent: No ANS identity is bound to the domain; the agent cannot be verified at any of ANS's three assurance tiers (Bronze/Silver/Gold)
```

Not probed live: no-fixed-path. The ANS draft defines no fixed well-known path or record type.

## History
- 2026-09-05 — seeded from Exa Agent research run
- 2026-09-06 — verified against draft-narajala-courtney-ansv2-01 primary text and the GoDaddy/Infoblox press release

## Instances

- [GoDaddy (ans reference implementation, "Plan G")](https://github.com/godaddy/ans) · Observed 2026-05-16 · registry
- [GoDaddy / Infoblox joint standards-support announcement](https://aboutus.godaddy.net/newsroom/news-releases/press-release-details/2026/Infoblox-and-GoDaddy-Support-Open-Standards-for-AI-Agent-Discovery-Identity-and-Verification-2026-0acKMntvOC/default.aspx) · Observed 2026-05-14 · business

Every instance with its source is listed on the [instances page](/instances/).

## See also

## References

- ANS v2 anchors every agent identity to a DNS domain name, issues dual PKI certificates via an ACME-verified Registration Authority, seals lifecycle events into a SCITT-aligned Transparency Log, and defines three assurance tiers (Bronze: PKI; Silver: PKI+DANE; Gold: PKI+DANE+Transparency Log) — [https://datatracker.ietf.org/doc/draft-narajala-courtney-ansv2/](https://datatracker.ietf.org/doc/draft-narajala-courtney-ansv2/) (2026-04-15) VERIFIED
- GoDaddy and Infoblox announced joint support for open standards for AI-agent discovery, identity and verification — [https://aboutus.godaddy.net/newsroom/news-releases/press-release-details/2026/Infoblox-and-GoDaddy-Support-Open-Standards-for-AI-Agent-Discovery-Identity-and-Verification-2026-0acKMntvOC/default.aspx](https://aboutus.godaddy.net/newsroom/news-releases/press-release-details/2026/Infoblox-and-GoDaddy-Support-Open-Standards-for-AI-Agent-Discovery-Identity-and-Verification-2026-0acKMntvOC/default.aspx) (2026-05-14) REPORTED

Disputed: This is an Independent Submission with no IETF working-group sponsorship and no implementation found in this pass; the GoDaddy/Infoblox press release announces support for standards in this space generally and should not be read as confirmation that ANS v2 specifically has been deployed.

[JSON](/data/protocols/ans.json) · [Markdown](/protocols/ans/index.md)