Help a n00b - Offchain Gasless DNSSEC Names in ENS

pmbug · April 25, 2024, 8:30am

I own a website (domain). I want to establish the free, corresponding ENS name for it. I have read:

and

but it’s really not clear what exactly I need to do. I’m understanding that I need to ask my nameserver guy to create a TXT record for my site that looks something like this:

TXT @ ENS1 pmbug.com 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e

and then the nameserver guy needs to furnish me a “Digest”/hash that I can enter into my NameCheap dashboard for the site’s advanced DNS setting.

Is that TXT line the correct format (my site is pmbug.com)? How does the nameserver guy generate a corresponding digest/hash for that record?

Can I also add TXT records for non-ethereum wallet addresses? If not, how would I do that? Would I have to do an onchain method and then manage via the ENS site?

raffy · April 25, 2024, 11:30pm

To enable just an Ethereum address:

ENS1 dnsname.ens.eth 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e

The following is a technical demo:

TOR supports this feature, however in a purely-gasless setup, it can only relay your name to another server. TOG is one possible server.

I operate a demo TOG at https://raffy.xyz/tog/. It supports many different types of routers, which you can think of as applications that translate a name into ENS.

If you resolve the name a.b.c using the mydns router, the TOG will fetch the contents of https://a.b.c/mydns.json and display it in ENS, using the human-readable format defined in resolverworks/enson.js.

It also lets you specify a basename: if base=raffy.xyz, then a.b.c will translate to https://raffy.xyz/mydns/a.b.c.json.

I created pmbug.raffy.xyz with the following DNS TXT:

ENS1 0x84c5AdB77dd9f362A1a3480009992d8d47325dc3 0x2Fc3Fd8444211091De2DF9052741f80e4d78eeee https://raffy.xyz/tog/mydns/e1?base=raffy.xyz

0x84c5..5dc3 — TOR contract on mainnet
0x2Fc3..eeee — the signer of my server
https://raffy.xyz/tog/mydns/e1?base=raffy.xyz
- URL of my server
- /mydns — which router to use
- /e1 — which TOR resolver
- ?base=raffy.eth — provide an alternative basename to mydns

I also created https://raffy.xyz/mydns/pmbug.raffy.xyz.json

{
	"name": "pmbug",
	"description": "TOR/TOG demo for ENS",
	"avatar": "https://discuss.ens.domains/user_avatar/discuss.ens.domains/pmbug/144/10474_2.png",
	"$eth": "0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e",
	"$btc": "1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa",
	"url": "https://discuss.ens.domains/t/help-a-n00b-offchain-gasless-dnssec-names-in-ens/19137"
}

You can test this yourself:

Set your DNS TXT:

ENS1 0x84c5AdB77dd9f362A1a3480009992d8d47325dc3 0x2Fc3Fd8444211091De2DF9052741f80e4d78eeee https://raffy.xyz/tog/mydns/e1

Create a JSON file at https://pmbug.com/mydns.json
Resolve pmbug.com in ENS

pmbug · April 30, 2024, 7:18pm

Thank you raffy for your detailed and thoughtful reply. Unfortunately, I’m a simple guy and 99% of what you posted went way over my head.

What I got from your response is that this offchain method was really only designed to effect a ENS mapping for an Ethereum address and it takes quite a bit work to try and set up addresses for other crypto tokens/blockchains.

Even with respect to the Ethereum address I’m sadly still confused as to what needs to be done. You said:

To enable just an Ethereum address:
ENS1 dnsname.ens.eth 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e

What is considered “dnsname”? In my case would I need:

ENS1 www.pmbug.com.ens.eth 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e
or
ENS1 pmbug.com.ens.eth 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e

Is “.ens.eth” always appended and if so, what is the ENS name that I am establishing here (ie. what is the ENS name that I will eventually be able to share with people - “pmbug.com” or “pmbug.com.ens.eth”)?

If I have my webhost/server guy add that TXT record to the nameserver for me, is that all I need to do? Or do I need to create a DNSSEC record for my domain registrar (Namecheap) using some specific digest/hash value? If I need to create this record, how do I figure out what the digest/hash is supposed to be?

raffy · April 30, 2024, 11:49pm

Ah, I understand your confusion: dnsname.ens.eth is an actual ENS name for a resolver.

The general syntax is: ENS1 $RESOLVER $CONTEXT...

When you resolve pmbug.com in the gasless setup, the following happens:

First, your name is resolved according to ENSIP-10:
"pmbug.com" doesn’t exist on chain, try the parent
"com" does exist on-chain
get the on-chain resolver of "com" → OffchainDNSResolver
call OffchainDNSResolver.resolve("pmbug.com", ...)
OffchainDNSResolver requests a proof for the DNS TXT of pmbug.com
OffchainDNSResolver verifies the proof and looks for a TXT record that starts with "ENS1 "
if found, it parses $RESOLVER from the ENS1 record
if it’s an ENS name, it resolves it to a hex address, otherwise it expects a literal hex address
this is the actual resolver for your name
call $RESOLVER.resolve("pmbug.com", ..., $CONTEXT)
as a bonus: the $CONTEXT, which is the remaining part of your ENS1 record, is passed to this new resolver contract
dnsname.ens.eth is a special resolver, that when it receives a resolution request for your ETH address, it interprets the $CONTEXT as an ETH address and returns that.

So when you use: ENS1 dnsname.ens.eth 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e

This is like saying: To continue resolving my name, supply 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e to dnsname.ens.eth resolver —which is an immutable trustless contract that echos the supplied $CONTEXT as an ETH address.

TOR contract fills the same role as dnsname.ens.eth, it except it interprets the $CONTEXT differently.

instead of $CONTEXT being your literal ETH address, the $CONTEXT is parsed as two separate arguments: a $SIGNER (another ETH address) and $ENDPOINT the location of an offchain server.
TOR make an offchain request to $ENDPOINT
TOR verifies the response was signed by $SIGNER
TOR then returns the corresponding data
this allows TOR to support any text record, any address record, contenthash, etc.

In this picture:

Resolver is the resolver for “xyz” in ENS
DNS ENS1 shows the different parts of the DNS TXT record
DNS Resolver is what I set in my ENS1 record ($RESOLVER above)
In this example, DNS Resolver = TOR
https://raffy.xyz/tog/fixed/e1 is my server
0x2Fc3Fd8444211091De2DF9052741f80e4d78eeee is the signer for my servers responses
As you can see, there are multiple text and address records.

pmbug · May 1, 2024, 3:14pm

Oh snap! lol. I thought “dnsname” was a placeholder for my domain name - a variable for simple text replacement. So the wallet address is really the only variable in the TXT line that I need to set/replace.

So, place the TXT record in my domain’s nameserver/DNS and that’s it? What is all the fuss about DNSSEC then? Is that for more advanced stuff like what Coinbase is doing with the <>.cb.id names with Coinbase Wallet?

raffy · May 1, 2024, 7:13pm

DNSSEC is required so your DNS TXT record can be proven (by an on-chain contract.)

FYI, there is an OffchainDNSResolver on all of the major TLDs (com, net, org, etc.). That contract has the potential to provide records for any DNS name that isn’t imported into ENS.

This is similar to DNS providers (many ISPs in early 2000s) that serve ads or redirects on domains that don’t exist, except OffchainDNSResolver will only utilize the corresponding ENS1 record if there is a valid DNSSEC proof, that the resolver itself can verify.

pmbug · May 1, 2024, 11:48pm

OK, then I’m lost again. I can ask my server guy to add the TXT record to the DNS for my website. Namecheap (my domain registrar) allows me to set a DNSSEC record, but I have no idea how to figure out what data (the “Digest”/hash) needs to go there.

Also, I’m sorry, but I did not understand your comment regarding an OffchainDNSResolver. Is this a different mechanism than putting a TXT record in the DNS and then setting a DNSSEC record? Are you saying that the TXT record could reference “OffchainDNSResolver” instead of " dnsname.ens.eth"?

raffy · May 2, 2024, 12:37am

Sorry I’m giving too much information.

For Namecheap, you just need to enable DNSSEC (on/off). Namecheap should automatically manage the corresponding DNSSEC records (RRSIG, DS, DNSKEY, etc.).

Then update your DNS TXT record:

ENS1 dnsname.ens.eth 0xcc9506Fa9c23f5f00fC6305374072862cAd57B3e

And resolve pmbug.com in ENS.

pmbug · May 2, 2024, 3:46pm

Thank you raffy. I appreciate your patience and willingness to help me.

I will give it a try.