Agents are becoming reachable services. They need names they own.

Most agent infrastructure treats an agent as something that makes calls. Increasingly it is also something that receives them. It serves an MCP endpoint, publishes an A2A card, takes a webhook, gets written to. The moment an agent is reachable by a stranger, it needs an identity that stranger can check.

Today that identity is a path under somebody else's domain. That makes the agent a tenant. It shares a cookie scope and a reputation with every other tenant, it cannot be verified independently, and it disappears when the platform does.

A registrable domain already does everything an agent identity needs, and none of it has to be invented.

DNSSEC gives it a trust chain rooted at the root zone, so a validating resolver takes no answer but the real one. A TXT record carries its public key or enclave attestation. MX gives it an address that receives mail. TLSA pins the certificate it serves. SRV, HTTPS and SVCB describe how to reach it.

The only thing a domain cannot do is arrive in a second. It takes a person, a card and a day, which is exactly why platforms hand out subdomains instead.

That is what I built DNSMint for. One API call returns a registered domain with the certificate already on it. We implement DNS-01, dns-account-01 and dns-persist-01 so the certificate side is automatic, sign every zone with its DS at the registry before it serves, and expose an MCP endpoint at https://dnsmint.com/mcp so an agent can ask for the hostname itself mid-task rather than waiting for someone to write a config.

If you are building something where agents are addressed rather than just invoked, I would like to hear how you are handling identity today.