aeo-record

Check a domain's AEO record (v=AEO1) — the DNS-layer standard for AI answer-engine verification, the way SPF/DKIM/DMARC work for email — and independently verify its Ed25519 signature against the catalog's published facts. Spec: aeorecord.org.

Zero dependencies. Node ≥18 (uses global fetch; signature verification uses WebCrypto Ed25519 with a node:crypto fallback). Checks /.well-known/aeo.json first (works with any crawler today), then the authoritative _aeo.<domain> DNS TXT record via DNS-over-HTTPS — so it also works in browsers, edge runtimes, and hosts where port-53 DNS is blocked.

CLI

npx aeo-record groundedaeo.com

Prints the record plus a signature block. Exit code 0 if a record is found, 1 if not.

Library

import { checkAeo, verifyAeo } from 'aeo-record'

// Discovery only
const record = await checkAeo('groundedaeo.com')
// { found: true, source: 'well-known' | 'dns', tier: 'listed', catalog: '…', sig: '…', ... }

// Discovery + independent signature verification
const verified = await verifyAeo('groundedaeo.com')
// { ...record, signature: { present: true, checked: true, valid: true, key_id: 'grd-2026-07' } }

The record format

_aeo.yourdomain.com  TXT  "v=AEO1; id=grd_abc123; catalog=https://groundedaeo.com/c/yourdomain.com; tier=listed; ts=20260703; sig=BASE64URL_ED25519_SIGNATURE"

| Tag | Required | Meaning | |-----|----------|---------| | v=AEO1 | yes | Record version | | id= | verified tiers | Issued token proving the domain authorized its catalog entry | | catalog= | yes | Stable URL of the verified catalog record (none for self-declared) | | tier= | yes | self_declared / listed / verified / grounded | | ts= | yes | Date of last verification (YYYYMMDD) — freshness signal | | sig= | paid tiers | base64url Ed25519 signature of the catalog record (see below) |

Signature verification

sig= cryptographically binds the record to the catalog content, so anyone can confirm the facts haven't been tampered with — without trusting the catalog API (tampered facts change the hash and the signature fails). Issued for all paid tiers (listed/verified/grounded); self-declared records are honestly unsigned.

message    = "AEO1|" + domain + "|" + tier + "|" + ts + "|" + facts_hash
facts_hash = sha256 hex of JSON.stringify(published facts as {fact_type, key, value}
             objects, sorted by fact_type, then key, then value — codepoint order)
sig        = base64url Ed25519 signature of the UTF-8 message

Everything is discovered from the record's own catalog= origin (issuer-neutral):

• published facts: {origin}/api/companies/{domain} → .facts[]
• verification keys: {origin}/.well-known/aeo-public-key.json → .keys[] (public_key = base64url raw 32-byte Ed25519 key)

Key status (spec v0.2): keys marked active or retired are used for verification — retired is normal rotation, so records signed before a rotation keep verifying. Keys marked revoked are skipped entirely (compromised key; even old signatures made with it are untrusted). A key with no status is treated as active. The isUsableKey(key) helper is exported if you iterate keys yourself.

verifyAeo() does all of this for you. Semantics of the result:

• valid: true — the record matches the catalog's current published facts.
• valid: false — stale or tampered: either the facts changed since the record was issued (the domain owner should re-issue the record) or the content doesn't match what was signed. Fetch the current record from the catalog to tell which.
• checked: false — a signature is present but couldn't be verified (catalog or keys unreachable); the reason says why.

Low-level building blocks are exported too: parseAeoTxt, canonicalFactsHash, verifyRecordSignature, isUsableKey.

Generate a free self-declared record at groundedaeo.com/free-record — no account needed. Verified, signed, continuously-refreshed records: groundedaeo.com.

License

MIT © Meadow Mountain AI LLC