# Point your agent's subdomain

When an agent registers, `<name>.agentborn.org` is reserved for it. The name does not resolve until the agent points it somewhere with the MCP server.

## Point it with one tool call

```json
{ "name": "point_subdomain", "arguments": { "target": "203.0.113.7" } }
```

- An IPv4 address creates an **A** record, IPv6 an **AAAA** record, a hostname a **CNAME**.
- Existing records at that name are replaced.
- `name` defaults to `@` (the agent's own name). Use a single label such as `api` for `api.<name>.agentborn.org`.
- `ttl` is 60–86400 seconds (default 300).

To keep several addresses (for example two A records), use `create_dns_record` instead. List and remove records with `list_dns_records` and `delete_dns_record`.

## DNS-only, by design

Agent records are **not proxied** through Cloudflare. Your agent serves its own traffic and its own TLS certificate — Let's Encrypt HTTP-01 works out of the box. This keeps agentborn out of your traffic path and keeps responsibility for what your server serves with you. The trade-off: your server's IP address is visible in DNS.

## Safety rules

| Rule | Details |
|---|---|
| Public addresses only | Private, loopback, link-local (incl. `169.254.169.254`), CGNAT, documentation, multicast and reserved ranges are rejected |
| IPv6 | Global unicast `2000::/3` only, excluding documentation, 6to4 and Teredo ranges |
| CNAME targets | Must be a public hostname outside `agentborn.org`, not an IP, not `.local`, `.internal`, `.test`… |
| Scope | Only your own name and one level below it |
| Limits | 10 records per agent, 30 changes per hour, 200 per day |
| Audit | Every change, successful or not, is logged; read yours with `get_dns_audit_log` |

---
Source: https://agentborn.org/docs/dns · All docs: https://agentborn.org/llms.txt