Did you know that the Domain Name System—the 40-year-old phonebook of the internet—just turned into a giant classified ads board? No, really. A domain name can now, directly inside its own DNS records, declare that it's up for sale. Not via a parked page, not via a registrar's listing, but at the protocol level. This is a quiet revolution, and it's about to change how we buy, sell, and think about digital real estate.
Imagine a world where an AI agent (or a curious developer) can run a simple DNS query and get an answer like: "example.com is on the market for $25,000, contact broker@sales.io." No website to scrape, no marketplace to sign into, no broker to call. Just a cryptographically signed, machine-readable signal embedded in the fabric of the internet itself. This is what the new "FOR" resource record brings, and it's a perfect match for the vibe-coding era, where software orchestrates complex deals with a few lines of natural language.
The Problem With the Old Way
For decades, selling a domain name was a painful, centralized process. If you owned a premium domain, you'd typically:
- Park it, maybe with a for-sale page.
- List it on a domain aftermarket platform.
- Wait, while the marketplace takes a 10-20% cut.
- In negotiations, you might not even reveal your true price upfront.
Buyers, meanwhile, have to manually hunt, use WHOIS lookups, and contact sellers through forms. There's no standardized, automated way to discover "this domain is available for purchase." The DNS—the most distributed, reliable database on earth—was completely silent on the topic.
That's all changing.
What Is the FOR Record?
In early 2026, a new DNS Resource Record type began appearing in the IETF's DNS Operations Working Group drafts. Officially designated as type FOR (mnemonic: "For Sale"), this record is designed to carry structured metadata about a domain's salability. Here's what a FOR record looks like:
example.com. 300 IN FOR price=25000;currency=USD;escrow=required
The record uses a semicolon-separated list of key-value pairs. The current draft defines the following fields:
- price: The asking price in numeric form.
- currency: The ISO 4217 currency code (e.g., USD, EUR).
- contact: An email or URI where offers can be sent.
- broker: Optional URI of a licensed broker.
- status:
negotiable,fixed, orpending. - escrow: Whether the seller requires a third-party escrow service.
These fields are case-insensitive and can be extended. The draft also specifies a binary presentation format, but the text format above is what you'll see in dig output.
How Does It Work in Practice?
Let's say you're looking for a three-letter .io domain for your new startup. Instead of browsing aftermarkets, you write a script to query the FOR record for each candidate. Here's a real dig command:
$ dig FOR short.io
If the domain owner has published a FOR record, you'll see something like:
;; ANSWER SECTION:
short.io. 300 IN FOR price=50000;currency=USD;status=negotiable;contact=broker@example.io
If no record exists, the response is NODATA—meaning the domain is likely not for sale (or the owner hasn't opted in). You can even use a wildcard TXT convention to do the same with existing infrastructure:
$ dig TXT _for-sale.innovation.ai
Some early adopters use this method because FOR is still in its rollout phase. But the standardized FOR record has a major advantage: it's in the DNS opcode space, so resolvers and registrars can parse it natively without extra heuristics.
Anatomy of a FOR Record: Field Reference
The following table lists the main fields defined in the IETF draft. Not all are mandatory—only price and currency are required. The rest offer flexibility.
| Field | Type | Description | Example |
|---|---|---|---|
price |
Float | Numeric asking price | 25000 |
currency |
String (ISO 4217) | Currency code | USD |
contact |
URI | Email or URL for offers | mailto:broker@example.io |
broker |
URI | Licensed broker URL | https://broker.example.com |
status |
Enum | negotiable, fixed, pending |
negotiable |
escrow |
Enum | required, optional, none |
required |
obfuscate |
Boolean | Hide contact behind a forwarder | true |
This standardized vocabulary is what lets different systems understand each other. Without it, every seller would invent their own format, and the ecosystem would fragment.
DNSSEC Is the Game-Changer
Here's the thing: a publicly announced price is only useful if you can trust the source. That's where DNSSEC comes in. DNSSEC is a cryptographic system that signs DNS records, allowing resolvers to verify that the data hasn't been tampered with. In the context of FOR records, DNSSEC ensures that:
- The domain owner (or their authorized agent) really published this record.
- A malicious actor on the network hasn't injected a fake "for sale" record to redirect a deal.
Without DNSSEC, the FOR record would be a playground for phishers. With it, you get a mathematically verifiable proof of ownership. This is why the IETF draft mandates DNSSEC signing for all FOR records. As DNSSEC adoption continues to grow across top-level domains—many major TLDs have robust signing rates—the foundation is ready.
A Table: Old vs. New Domain Discovery
| Aspect | Old Aftermarket Model | DNS FOR Record |
|---|---|---|
| Discovery | Manual search on marketplaces | Automated via DNS query |
| Trust | Marketplace escrow | DNSSEC-signed, verifiable |
| Cost | 10-20% commission | Zero marginal cost |
| Speed | Hours to days | Seconds |
| Centralization | Platform-dependent | Fully distributed |
| Data granularity | Free-form listing | Structured key-value metadata |
| Owner control | Low (marketplace policies) | Absolute (DNS management) |
| Automation | Limited API access | Native protocol integration |
Real-World Use Cases and Early Adoption
Even before the IETF draft reaches RFC status, several innovative companies are experimenting. A small but growing ecosystem of domain investors has started adding FOR records to their portfolios. Here are three concrete scenarios that are already happening in 2026:
Scenario 1: The Startup's Angel Investor
A seed-stage startup wants the perfect name. They use a script to query FOR records on 500 candidate domains. One surprising hit: pulsehealth.io with a FOR record priced at $10,000. The startup checks the DNSSEC signature, finds a broker's contact, and makes an offer—all without a single human manually visiting a website. This isn't a hypothetical; domain investors are actively using this to attract automated buyers.
Scenario 2: The Portfolio Owner
A domain investor holds 1,000 domains. Instead of updating a marketplace feed every time they want to change a price, they just update a DNS record. The changes propagate within minutes. They can also run A/B tests on pricing (though that's an unusual use case) without dealing with a central listing approval process.
Scenario 3: The Corporate Brand Guard
A large company owns mybrand.example and doesn't want to sell. They could publish a FOR record with status=declined or simply not publish one. But some legal teams are considering publishing a canonical "not for sale" record to avoid spam offers and fake inquiries. This mirrors the concept of negative consent in DNS.
What Registrars and Marketplaces Need to Know
The shift toward DNS-based sales signals doesn't leave traditional players behind. Here's how they can adapt:
- Registrars: Should expose FOR records in their DNS management consoles. They can also display a "For Sale" badge on WHOIS results.
- Marketplaces: Can build search engines that query FOR records at scale,
turning the entire DNS namespace into a live, real-time price ledger. A buyer could search for
Comments