D1–D6 Agent-Trust Domain Metrics: framework reference

Can an agent resolve the domain's purpose from the domain name alone, without fetching any files or reading any content? This is the first signal agents process.

• High: Name directly encodes the domain's scope — semanticnamespace.org signals semantic namespace reference; semantic-domains.com signals domain assessment. No inference required.
• Medium: Name is plausibly related to the actual scope but requires context to confirm — a compound name where one term is generic, or a brand name with adjacent-domain recognition.
• Low: Name is a brand, acronym, or generic term with no semantic signal. Agents must infer purpose entirely from declarations and content rather than the name itself.
• How to assess: Cover the site content. Read only the domain name. Could a well-informed agent categorize the domain's primary subject without additional signals?

Are the machine-readable metadata signals — JSON-LD schema, Open Graph Protocol tags, meta descriptions — consistent with the domain name and with each other?

• High: JSON-LD @type is specific and appropriate (WebSite, Organization, TechArticle); description is role-specific and non-generic; OGP tags consistent with LD+JSON; meta description non-boilerplate.
• Medium: JSON-LD present but uses only generic WebSite type with minimal description; one tag contradicts another; meta description is templated.
• Low: No JSON-LD; schema contradicts domain name or visible content; multiple inconsistent signals across tag types.
• How to assess: Fetch /. Parse JSON-LD, OGP, and meta description. Check consistency across all three. Verify description is specific enough to distinguish this domain from a similar one.

Does the domain publish the structural files that agents expect to find before indexing content? This is the compliance checklist for agent-readable infrastructure.

• Full: All five present — robots.txt with named AI crawler UA directives, sitemap.xml covering all content pages, AGENTS.md with role and scope, /.well-known/agent.json with machine-readable identity, /.well-known/namespace-cluster.json if cluster member.
• Partial: Core files present (robots.txt, sitemap.xml) but agent-specific declarations absent (AGENTS.md, agent.json).
• Low: Only robots.txt present, or robots.txt blocks AI crawlers, or no agent-readable infrastructure at all.
• How to assess: Fetch each file directly. For robots.txt, verify named AI UA directives (ClaudeBot, GPTBot, Google-Extended, Meta-ExternalAgent). For sitemap.xml, verify it lists all deployed content pages. For agent.json, verify all required fields are present and non-empty.

Has at least one named AI crawler visited the domain within the active window (90 days)? A domain with no AI crawler visits is absent from agent retrieval pipelines regardless of its structural quality.

• Active: At least one named AI crawler (ClaudeBot, GPTBot, Google-Extended, Meta-ExternalAgent, Applebot, PerplexityBot) has visited within 90 days. Multiple distinct crawlers visiting is a stronger signal.
• Stale: AI crawler visits present in logs but older than 90 days. Domain was indexed but has not been recrawled — content updates may not be reflected in agent knowledge.
• Dark: No AI crawler visits in logs, or no log data available. Domain is structurally sound but absent from active agent retrieval pipelines.
• How to assess: See Crawler-Liveness Instrumentation section below.

Does the domain demonstrate technical trust signals at the protocol layer — DNSSEC, TLS chain integrity, and anti-cloaking consistency?

• DNSSEC: Domain has DNSSEC enabled and resolving cleanly. Verifiable via dig +dnssec [domain] A or DNSSEC validators. DNSSEC prevents DNS spoofing that could redirect agents to malicious content.
• TLS chain integrity: Valid certificate from a recognized CA, full chain present, no mixed-content warnings. Certifiable via TLS inspection tools. A broken TLS chain causes agent HTTP clients to refuse connection.
• Anti-cloaking consistency: The same content is served to named AI crawler UA strings as to standard browser UA strings. Agents that detect content cloaking (different content served to bots vs. humans) will downgrade trust scores or refuse to index.
• How to assess: DNSSEC: dig +dnssec [domain] A and check for AD flag. TLS: fetch with curl -v and inspect certificate chain. Anti-cloaking: fetch with ClaudeBot UA string and with standard browser UA, compare content.

Does the domain have a stable governance history — domain age, secure registrar, no recent ownership changes — that supports long-term agent trust?

• Domain age: Registered more than 24 months ago with no ownership transfers. Older domains with stable history receive higher baseline trust in agent systems that weight governance signals.
• Registrar security tier: Registered through a high-security registrar (Cloudflare Registrar, Namecheap, Google Domains) with registry lock enabled. Low-tier registrars with poor abuse response are treated as risk signals.
• Ownership continuity: WHOIS history shows no recent ownership transfers. A domain that recently changed hands may carry a different trust history than its current operator intends.
• How to assess: WHOIS lookup for creation date, registrar, and transfer history. Check for registry lock status. Compare WHOIS registration date against the domain's oldest archived content.