The Next Decade of Domain Identity: How Domains Become Proof You're Real

Domain identity is the evidence a domain gives that it is real: authenticated email, a consistent public record over time, and, increasingly, cryptographic checks that machines can run. DNS tells systems where a domain is. Over the next decade, email providers, standards bodies and AI-agent protocols are building the layer that tells them whether to trust it.

Thirty articles ago, we started with a simple observation: a parked domain is not neutral. It isn't resting. It isn't waiting. It's broadcasting absence to every system that checks.

From there, we traced what happens when absence compounds, and what happens when presence does instead. Machine legitimacy. Stewardship over time. Market structure that rewards care over speculation. These were separate threads. For twenty-nine articles, they felt like different conversations.

They aren't separate anymore.

Something is converging. Gmail, Yahoo and Outlook.com now require bulk senders to authenticate their domains with SPF, DKIM and DMARC, and deliverability starts before you hit send. Gartner predicts that by 2028, 90% of B2B buying will be AI agent intermediated. Protocols that let an agent prove who it is are already being built.

Each system asks the same question: "Is this real?"

The domain is how they find out.

What is domain identity, and why did DNS never solve it?

In November 1983, Paul Mockapetris published RFC 882 and RFC 883, the specifications for the Domain Name System. Before that, the network's host names lived in one file. RFC 882 describes it: hosts in the ARPA Internet were "registered with the Network Information Center (NIC) and listed in a global table (available as the file HOSTS.TXT on the SRI-NIC host)." The registry was run centrally by Elizabeth Feinler's group at SRI, which the Internet Hall of Fame says managed the Host Naming Registry for the Internet from 1972 until 1989. DNS replaced that central table with a distributed, scalable system that maps human-readable names to machine-readable addresses.

DNS answered one question: where is this?

It was never designed to answer a second question: is this real?

Security extensions got part of the way. RFC 4033, published in March 2005, describes DNSSEC as adding "data origin authentication and data integrity to the Domain Name System," which shows that an answer came from the right source and wasn't altered. Proving who controls a domain is still a different thing from proving who operates it. The IETF's Agent Name Service draft makes the same distinction: domain control validation confirms who controls the domain's DNS records or web server, not the legal entity operating behind it.

For forty years, that gap didn't matter much. Humans visited websites. They evaluated what they saw. They made trust decisions the way humans always have, based on appearance. A polished design. A professional logo. A .com in the address bar. Trust was aesthetic. Identity was assumed.

That era is ending. The internet has two audiences, the machine that arrives first and the human who may never arrive at all. And the machine doesn't evaluate aesthetics. It evaluates signals.

What did the W3C change in 2025?

On May 15, 2025, the W3C published Verifiable Credentials 2.0 as a W3C Standard, a way to express, exchange and verify digital credentials. The release defines a credential as "a set of claims made by an issuer about a subject." This wasn't a draft or a working-group paper. It's the web's standards body formalizing how verification claims are expressed.

We want to be precise about what that shows. It doesn't make domains an identity system, and it doesn't mention domain names as identity. It shows that verification is becoming a standardized part of the web's plumbing. Our reading is that the domain, the human-readable anchor people already use, is where that plumbing will attach. Trust is a system, not a feeling, and the internet is finally building infrastructure to match.

What is already in force for domain identity today?

Before the predictions, the rules that already apply. These are documented, current and checkable.

Which email authentication rules apply?

Google, Yahoo and Microsoft all set domain-level authentication requirements, with different thresholds.

Two details are easy to get wrong. A DMARC policy of p=none satisfies the requirement, so "has DMARC" doesn't mean "enforces DMARC." And enforcement is progressive: Google says that starting in November 2025, Gmail is ramping up enforcement on non-compliant mail, with temporary and permanent rejections. It isn't a switch that blocks every unauthenticated message at once. Our guide to what a new domain needs before it sends covers the full requirements and why passing them isn't enough on its own.

How many domains actually meet that bar?

Fewer than the rules would suggest. EasyDMARC's 2025 State of DMARC report, covering the top 1.8 million email domains, found only 7.7% fully protected at p=reject and 52.2% with no DMARC record at all. EasyDMARC's own analysis puts DMARC adoption at 47.6% in 2025, up from 27.3% in 2023, and says over 80% of domains globally either lack a DMARC record or use a non-enforcing policy. The percentages differ because the definitions differ: reject-only versus any enforcing policy.

Meanwhile, the registry keeps growing. The Domain Name Industry Brief (DNIB.com, sponsored by Verisign) reported 401.6 million domain name registrations at the end of Q2 2026, up 29.9 million, or 8.1%, year over year. Domains aren't shrinking. People and organizations keep acquiring them. The question is no longer how many domains exist. It's how many are legible.

What's changing about certificates?

Certificates are getting shorter-lived, which makes continuous control of your DNS a standing requirement. The CA/Browser Forum's ballot SC-081 cuts the maximum validity of public TLS certificates to 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, and shortens how long validation data can be reused. The ballot's rationale is that "certificates are representations of a point in time state of reality." For what that means for site owners in practice, see the myth of "set and forget".

What does the next decade look like for machine legitimacy?

Here's where three lanes converge, and the domain is the common denominator in all of them. The first lane is machine legitimacy: how software decides whether another party is who it claims to be.

What does Gartner predict about AI agents?

Two forecasts frame the timeline. In October 2025, Gartner predicted that "by 2028, 90% of B2B buying will be AI agent intermediated, pushing over $15 trillion of B2B spend through AI agent exchanges." In August 2025, it predicted that "forty percent of enterprise applications will be integrated with task-specific AI agents by the end of 2026, up from less than 5% today."

These are forecasts, not measurements, and the second one comes due in about twelve weeks. Read them as a direction. When agents do the shopping, the question of who an agent is dealing with becomes a practical one.

What identity infrastructure for agents is actually being built?

Several efforts, with different anchors.

GoDaddy's Agent Name Service (ANS). On October 2, 2025, GoDaddy announced a naming system for AI agents with four components: discovery through DNS, X.509 certificate-based verification, protocol-agnostic adapters and lifecycle management for registration, renewal and revocation. It draws on concepts in an IETF draft for an Agent Name Service. GoDaddy's technical post describes domain validation through ACME DNS-01, DNSSEC and transparency logs. On April 2, 2026, GoDaddy and LegalZoom announced that LegalZoom had registered its first agent, an MCP server, on ANS. GoDaddy's Travis Muhlestein said, "Trust is the currency of online business."

The IETF side is early. The ANS v2 Internet-Draft (draft-narajala-courtney-ansv2-01, April 13, 2026) is an individual submission, not a working-group document or an RFC, and it expires on October 15, 2026. GoDaddy said general availability would follow a developer preview. We couldn't confirm that it has arrived.

Cloudflare's Web Bot Auth. Cloudflare's documentation describes bots signing their requests, with a Signature-Agent header pointing to a key directory hosted at a well-known path on the bot operator's domain. Its launch post says HTTP message signatures "allow bots to authenticate themselves and allow customer origins to identify them." That's a domain-hosted key set, not a check that the domain's owner is who they claim to be.

Google's AP2. Google's Agent Payments Protocol uses cryptographically signed mandates that prove a user authorized a purchase. It's credential-based, not domain-based.

So is it true that agents verify an entity before they transact? Partly. Protocols already let a counterparty check an agent's cryptographic identity before accepting its requests, and ANS proposes anchoring that identity to a domain. Neither is universal yet. The honest version of the claim is that verification is being built, with the domain as one of the candidate anchors.

What's in force, what's emerging and what's only predicted?

How do stewardship and market structure fit into domain identity?

Machine legitimacy is the lane with the most documentation. The other two are harder to measure, so we label them as what they are: evidence, then our reading of it.

Why does a domain's history matter?

Stewardship is the second lane: what a domain has done over time. Google doesn't publish how long a domain's past follows it, but one data point is on record. In a Reddit reply reported by Search Engine Journal on September 30, 2025, Google's John Mueller said, "Sometimes it just takes a lot of time for the old state of a domain to be shaken off (sometimes that's also the case when it was parked for a while), and the site to be treated like something new / independent." That's a secondary report of a forum comment, not documentation. It does suggest that a domain's past doesn't reset the moment its situation changes.

Our reading is that continuity is the one signal that can't be bought quickly. A domain that has resolved, authenticated and published consistently for years has a record a new registration doesn't. We made the longer case in why six years of content beats six months of marketing, and we treat it as a reasoned position, not a measured effect.

What is the domain industry saying?

The third lane is market structure: where the industry itself expects value to move. In its December 20, 2025 retrospective, CircleID carried a commentary by Simone Catania of InterNetX that says the source of value "is shifting from memorable, human-first domain names to domains as verified identity, trust anchors for AI agents." In the original, that line sits inside inner quotation marks, so it may be quoting another source. Read it as industry commentary, not a measurement. The registry numbers above show growth in domains, not a shift in what they're worth.

How do the three lanes fit together?

The three lanes ask different questions of the same asset.

If you've followed the series, the pieces connect. A parked domain isn't neutral. Signals are the asset. Content is memory. Trust is a system. And the shift from ownership to stewardship is what holds them together.

Which is why we think the thesis resolves into three sentences. Domains are identity. Identity requires care. Care compounds.

What should you do about domain identity now?

You don't need to predict which standard wins. The steps below are either required today or useful whichever way the standards settle. They're also the order we'd work in: documented requirements first, longer-term positioning after.

How do you prove a domain is real? Five steps

1. Authenticate every domain that sends email. Set up SPF, DKIM and DMARC, starting with a DMARC policy of p=none while you read the reports, then tighten it once legitimate mail is passing. This is the one step with a documented deadline. The mechanics are in what a new domain needs before it sends.
2. Keep control of your DNS and renewals. Certificates now expire sooner and validation depends on your DNS, so a lapsed domain or a forgotten record is a standing risk. Know what an expired domain can do to your brand and track every renewal date in one place.
3. Give every domain you keep something real to find. A page with content and a way to contact you tells machines and people that someone is there. A parked domain isn't neutral, and AI systems have trouble reading one.
4. State who you are in machine-readable form. Structured data that names your organization and links your official profiles helps software read the site. It isn't a ranking guarantee. We cover the basics in structured data for a domain before launch.
5. Review the portfolio on a schedule. Decide for each domain whether to maintain it, warm it or release it. A domain you can't commit to is one you can't make legible. The myth of "set and forget" explains what neglect costs.

What does this mean for founders with many domains?

Most of the work above scales badly by hand. If you hold a portfolio of names you haven't built on, each one carries the same identity questions: is it authenticated, is it renewing, is anything there? In our view, that's where portfolios quietly fail. Not through one dramatic mistake, but through dozens of small gaps nobody is watching.

This is the problem we built SiteWarming around. The Domain Management Tool shows every domain across every registrar in one view, so renewals don't surprise you. Launch & Warm gives the domains worth keeping content and a contact path, so each one has something real to find. The domain health check audits what's in place. You can read more about what SiteWarming is.

What's the point of all this?

The next decade will probably reward the domains that can show their work. The rules for that are already being written in the places that matter most: inboxes, certificate authorities, standards bodies and agent protocols. We can't tell you which proposal will become the standard. We can tell you that none of them favors a domain nobody tends.

Domains are identity. Identity requires care. Care compounds.

Frequently asked questions about domain identity

What is domain identity?

Domain identity is the evidence a domain gives that it is real: authenticated email, a consistent public record over time and, increasingly, cryptographic checks that software can run. DNS tells systems where a domain is. Domain identity is what helps them decide whether to trust it.

Does a domain prove who you are?

Not on its own. A domain shows control of DNS records or a web server, not the legal entity behind it. The IETF's Agent Name Service draft makes the same distinction. Authenticated email, a consistent history and verifiable credentials add evidence, but no single signal proves who operates a domain.

What is the Agent Name Service?

The Agent Name Service (ANS) is a naming system for AI agents that GoDaddy announced on October 2, 2025. It uses DNS for discovery and X.509 certificates for verification, and draws on an IETF individual draft, not a standard. GoDaddy said general availability would follow a developer preview; we couldn't confirm it has arrived.

Do Google, Yahoo and Microsoft require DMARC?

For bulk senders, yes, in different forms. Gmail requires a DMARC record from bulk senders, and a policy of none is allowed. Yahoo requires a valid DMARC policy for bulk senders. Outlook.com requires SPF, DKIM and DMARC from senders of 5,000 or more emails a day, effective May 5, 2025.

Is a DMARC policy of p=none enough?

It meets the minimum in Gmail's and Yahoo's bulk-sender rules, but it only monitors. A p=none policy tells receivers to take no action on mail that fails authentication, so it doesn't stop spoofing. EasyDMARC found only 7.7% of the top 1.8 million email domains at p=reject.

How many domains are registered?

The Domain Name Industry Brief, sponsored by Verisign, reported 401.6 million domain name registrations at the end of Q2 2026, up 29.9 million, or 8.1%, year over year. Registration counts say nothing about whether domains are authenticated or maintained. EasyDMARC found 52.2% of the top 1.8 million email domains had no DMARC record.

What is W3C Verifiable Credentials 2.0?

Verifiable Credentials 2.0 is a W3C Standard, published May 15, 2025, for expressing, exchanging and verifying digital credentials. The W3C defines a credential as a set of claims made by an issuer about a subject. It doesn't mention domain names as identity; applying it to domains is our reading, not part of the standard.

Will AI agents check a domain before they transact?

Some protocols already let a counterparty verify an agent's cryptographic identity, and ANS proposes anchoring that identity to a domain. None is universal yet, and Gartner's figures are forecasts. The accurate claim is that agent verification is being built, with the domain as one candidate anchor, not that agents always verify first.

Related reading

• Email deliverability starts before you hit send
• When agents do the shopping
• The two audiences of every domain
• Trust is a system, not a feeling
• From ownership to stewardship
• How AI search engines decide which domains to trust