DNSRegistrar

​

Contract Overview

• Accepting DNSSEC proofs of DNS ownership
• Validating proofs through the DNSSEC oracle
• Creating ENS records for proven DNS domains
• Managing the public suffix list

​

State Variables

​

Immutable References

ENS public immutable ens;
DNSSEC public immutable oracle;
address public immutable previousRegistrar;
address public immutable resolver;

• ens: The ENS registry contract
• oracle: The DNSSEC oracle for proof validation
• previousRegistrar: Previous registrar for migration support
• resolver: Default resolver for claimed domains

​

Public Suffix List

PublicSuffixList public suffixes;

​

Inception Tracking

mapping(bytes32 => uint32) public inceptions;

​

Constructor

constructor(
    address _previousRegistrar,
    address _resolver,
    DNSSEC _dnssec,
    PublicSuffixList _suffixes,
    ENS _ens
);

• _previousRegistrar: Address of the previous registrar for migration
• _resolver: Default resolver address for new domains
• _dnssec: DNSSEC oracle contract
• _suffixes: Public suffix list contract
• _ens: ENS registry contract

​

Core Functions

​

proveAndClaim

function proveAndClaim(
    bytes memory name,
    DNSSEC.RRSetWithSignature[] memory input
) public override;

• name: The DNS name to claim, in DNS wire format
• input: Chain of signed DNS RRSETs ending with a TXT record proving ownership

1. Verifies the DNSSEC proof through the oracle
2. Validates the parent domain is an enabled public suffix
3. Checks for a TXT record at _ens.<name> containing the owner address
4. Sets the ENS owner to the address from the TXT record

_ens.example.com. IN TXT "a=0x1234567890123456789012345678901234567890"

​

proveAndClaimWithResolver

function proveAndClaimWithResolver(
    bytes memory name,
    DNSSEC.RRSetWithSignature[] memory input,
    address resolver,
    address addr
) public override;

• name: The DNS name to claim
• input: Chain of signed DNS RRSETs
• resolver: Custom resolver address to set
• addr: Address to set in the resolver (optional, use address(0) to skip)

• msg.sender must match the owner specified in the DNS TXT record
• If addr is provided, resolver must not be address(0)

// Claim with custom resolver and address
registrar.proveAndClaimWithResolver(
    dnsName,
    proofs,
    customResolverAddress,
    myEthereumAddress
);

​

enableNode

function enableNode(bytes memory domain) public returns (bytes32 node);

• domain: The domain to enable, in DNS wire format

• Domain must be in the public suffix list

1. Validates domain is a recognized public suffix
2. Recursively creates parent nodes if needed
3. Sets the registrar as owner of intermediate nodes
4. Sets the default resolver for the node

​

Administrative Functions

​

setPublicSuffixList

function setPublicSuffixList(PublicSuffixList _suffixes) public onlyOwner;

• _suffixes: New PublicSuffixList contract address

​

Internal Functions

​

_claim

function _claim(
    bytes memory name,
    DNSSEC.RRSetWithSignature[] memory input
) internal returns (bytes32 parentNode, bytes32 labelHash, address addr);

1. Verifies the DNSSEC proof through the oracle
2. Extracts the first label and parent name
3. Enables the parent node if needed
4. Validates proof is not stale using inception time
5. Extracts owner address from TXT record
6. Emits Claim event

• parentNode: ENS node of the parent domain
• labelHash: Keccak256 hash of the claimed label
• addr: Owner address from the TXT record

​

_enableNode

function _enableNode(
    bytes memory domain,
    uint256 offset
) internal returns (bytes32 node);

• domain: Domain in DNS wire format
• offset: Current offset in the domain name

• Recursively processes from right to left (TLD to subdomain)
• Creates ENS records for unclaimed nodes
• Sets registrar as owner of intermediate nodes
• Takes over nodes owned by the previous registrar

​

Events

​

Claim

event Claim(
    bytes32 indexed node,
    address indexed owner,
    bytes dnsname,
    uint32 inception
);

• node: ENS node hash of the claimed name
• owner: Ethereum address that now owns the name
• dnsname: DNS name in wire format
• inception: Signature inception time from the DNSSEC proof

​

NewPublicSuffixList

event NewPublicSuffixList(address suffixes);

• suffixes: Address of the new PublicSuffixList contract

​

Errors

​

NoOwnerRecordFound

error NoOwnerRecordFound();

​

PermissionDenied

error PermissionDenied(address caller, address owner);

​

PreconditionNotMet

error PreconditionNotMet();

​

StaleProof

error StaleProof();

​

InvalidPublicSuffix

error InvalidPublicSuffix(bytes name);

​

DNS Wire Format

\x07example\x03com\x00

• \x07 = length of “example” (7 bytes)
• example = the label
• \x03 = length of “com” (3 bytes)
• com = the label
• \x00 = root label (empty)

​

TXT Record Format

a=0x<ethereum_address>

_ens.example.com. 3600 IN TXT "a=0x1234567890123456789012345678901234567890"

// From DNSClaimChecker.sol
function getOwnerAddress(
    bytes memory name,
    bytes memory data
) internal pure returns (address, bool) {
    // Prepends "_ens." to the name and searches for matching TXT record
    // Parses "a=0x..." format to extract address
}

​

Public Suffix List

interface PublicSuffixList {
    function isPublicSuffix(bytes calldata name) external view returns (bool);
}

• com is a public suffix (can be used as parent)
• example.com is NOT a public suffix (cannot be used as parent for other claims)

​

Integration Example

// 1. Set up contracts
DNSRegistrar registrar = DNSRegistrar(registrarAddress);

// 2. Prepare DNS name in wire format
bytes memory dnsName = hex"076578616d706c6503636f6d00"; // example.com

// 3. Collect DNSSEC proofs (typically done off-chain)
DNSSEC.RRSetWithSignature[] memory proofs = getProofsFromDNS();

// 4. Claim the domain
registrar.proveAndClaim(dnsName, proofs);

// Or claim with custom resolver
registrar.proveAndClaimWithResolver(
    dnsName,
    proofs,
    myResolverAddress,
    myEthereumAddress
);

​

Security Considerations

​

Proof Validation

• Signatures are cryptographically valid
• Chain of trust extends to root anchors
• Signatures are temporally valid

​

Stale Proof Prevention

if (!RRUtils.serialNumberGte(inception, inceptions[node])) {
    revert StaleProof();
}
inceptions[node] = inception;

​

Ownership Changes

1. Update the DNS TXT record with the new address
2. Submit a new DNSSEC proof with proveAndClaim

​

Related Contracts

• DNSSEC Oracle - Validates DNSSEC proofs
• DNSClaimChecker - Parses TXT records
• RRUtils - DNS record utilities