Claim a custom-domain namespace in the MCP Registry with DNS TXT authentication

Documented steps

1. Decide the namespace. Domain-based auth grants names of the form com.example.*/* — the reverse-DNS form of a domain you control. Ref: https://modelcontextprotocol.io/registry/authentication
2. Generate a signing key. Ed25519: `openssl genpkey -algorithm Ed25519 -out key.pem`. ECDSA P-384: `openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem`.
3. Derive the public key. Ed25519: PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)".
4. Publish the TXT record at the domain APEX (not a _selector subdomain): example.com. IN TXT "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}" — use k=ecdsap384 for the P-384 key.
5. Wait for DNS propagation, then confirm with `dig +short TXT example.com` before attempting login.
6. Derive the private key hex and log in: PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')"; `mcp-publisher login dns --domain "example.com" --private-key "${PRIVATE_KEY}"`.
7. For managed keys instead of a local file: `mcp-publisher login dns google-kms --domain=example.com --resource=projects/<p>/locations/global/keyRings/<kr>/cryptoKeys/<k>/cryptoKeyVersions/1` or `mcp-publisher login dns azure-key-vault --domain=example.com --vault <vault> --key <key>` — run the command once to print the 'Expected proof record' to paste into DNS.
8. Set server.json `name` to <reverse-dns>/<server> and run `mcp-publisher publish`.