https://dnsmesh.io dnsmesh-node

healthy

About this node

Endpoint: https://dnsmesh.io
Records served: 20
Operator pubkey: c0e5385eb53c1cdb62c5c5a726f1a552480fc345c600c8e45f2ef047fa2032c2
API: /health · /stats

Registration (DNS UPDATE / TSIG)

This node mints per-user TSIG keys. One HTTPS hop to register, then every record write is RFC 2136 DNS UPDATE under that key — no further HTTPS. (Default key lifetime: 90 days.)

Set a passphrase before dnsmesh init. It derives your Ed25519 + X25519 keys via Argon2id and is the only thing protecting your identity — losing it loses the identity, no recovery. The CLI reads $DMP_PASSPHRASE first, then the file at passphrase_file in your config, then prompts interactively.

pipx install dnsmesh
read -rs DMP_PASSPHRASE       # silent prompt, not in shell history
export DMP_PASSPHRASE
dnsmesh init alice@<your-zone> --endpoint dnsmesh.io
dnsmesh tsig register --node dnsmesh.io
dnsmesh identity publish

No subject allowlist — any user@example.com address can register.

What this node publishes via DNS

Inter-node coordination (M9) is DNS-only. Try these from any resolver:

dig @dnsmesh.io _dnsmesh-heartbeat.dmp.dnsmesh.io TXT +short
dig @dnsmesh.io _dnsmesh-seen.dmp.dnsmesh.io TXT +short

Each TXT value is a signed HeartbeatRecord wire. Verify locally with dnsmesh peers dmp.dnsmesh.io.

Recent peers (3)

Endpoint	Operator pubkey	Version	Last heard	Sources
https://dnsmesh.io	`c0e5385e...32c2`	0.6.6	0s ago	1
https://dnsmesh.pro	`55dd5085...bfef`	0.6.6	7m ago	1
https://dnsmesh.de	`fbe50814...cdd9`	0.6.6	7m ago	1

Raw discovery is DNS-only as of M9: dig @<node> _dnsmesh-heartbeat.<zone> TXT or _dnsmesh-seen.<zone>.

About DNS Mesh Protocol

Federated end-to-end encrypted messaging delivered over DNS. Identity = DNS name. No central directory, no phone numbers, no servers to trust. As of M9 the protocol speaks DNS both directions — reads via TXT queries, writes via RFC 2136 UPDATE under per-user TSIG keys. The only HTTPS exchange is the one-time TSIG-key registration step.