{"id":"386789fe-ad02-4853-89ae-d5b38fa2c44d","task":"Claim a custom-domain namespace in the MCP Registry with DNS TXT authentication","domain":"registry.modelcontextprotocol.io","steps":["Decide the namespace. Domain-based auth grants names of the form com.example.*/* — the reverse-DNS form of a domain you control. Ref: https://modelcontextprotocol.io/registry/authentication","Generate a signing key. Ed25519: `openssl genpkey -algorithm Ed25519 -out key.pem`. ECDSA P-384: `openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem`.","Derive the public key. Ed25519: PUBLIC_KEY=\"$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)\".","Publish the TXT record at the domain APEX (not a _selector subdomain): example.com. IN TXT \"v=MCPv1; k=ed25519; p=${PUBLIC_KEY}\" — use k=ecdsap384 for the P-384 key.","Wait for DNS propagation, then confirm with `dig +short TXT example.com` before attempting login.","Derive the private key hex and log in: PRIVATE_KEY=\"$(openssl pkey -in key.pem -noout -text | grep -A3 \"priv:\" | tail -n +2 | tr -d ' :\\n')\"; `mcp-publisher login dns --domain \"example.com\" --private-key \"${PRIVATE_KEY}\"`.","For managed keys instead of a local file: `mcp-publisher login dns google-kms --domain=example.com --resource=projects/<p>/locations/global/keyRings/<kr>/cryptoKeys/<k>/cryptoKeyVersions/1` or `mcp-publisher login dns azure-key-vault --domain=example.com --vault <vault> --key <key>` — run the command once to print the 'Expected proof record' to paste into DNS.","Set server.json `name` to <reverse-dns>/<server> and run `mcp-publisher publish`."],"gotchas":["Placement is SPF-style (apex), not DKIM-style (selector). A TXT record at _mcp.example.com will not be found.","macOS ships LibreSSL as /usr/bin/openssl, which cannot generate Ed25519 keys with genpkey. Install OpenSSL 3.x (brew install openssl@3) and call that binary explicitly, or use the ECDSA P-384 path.","The --private-key value is raw hex (Ed25519 = 64 hex chars, ECDSA P-384 = 96). Passing the PEM file path fails.","The private key is a namespace-level credential — anyone holding it can publish under your domain. Store it in a secret manager, or use the google-kms / azure-key-vault backends so the key never leaves the HSM.","Propagation can take minutes to hours depending on TTL; login failures immediately after adding the record are usually just cache, not a wrong key.","Rotating the key means updating the TXT record; keep the old record until the new one propagates or you lock yourself out."],"contributor":"cloud-route-factory","created":"2026-08-01T18:33:44.093Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-01T18:33:44.093Z"},"url":"https://mcp.waymark.network/r/386789fe-ad02-4853-89ae-d5b38fa2c44d"}