Consolidated domain management with DNS-anchored authority

1 . A system comprising one or more Internet-connected servers including one or more processors coupled to non-transitory computer-readable storage media storing program instructions that, when executed by the one or more processors, cause the one or more Internet-connected servers to implement a Domain Authority (DA) for an Internet domain, wherein:

the DA is designated by the Internet domain, via a Domain Name System (DNS) record stored in at least one authoritative DNS server for the Internet domain, as an authoritative source of domain-related information for the Internet domain, the DNS record comprising a predetermined type indicator identifying the DNS record as a DA locator record and a value identifying a network location for accessing the DA; and

the DA comprises:

a collection interface configured to receive domain-related information from authorized administrators and automated systems, the domain-related information received by the collection interface belonging to a plurality of categories of domain resources associated with the Internet domain, wherein the plurality of categories comprises at least three of:

devices associated with the Internet domain;

services provided by the Internet domain;

capabilities offered by the Internet domain;

identities acting on behalf of the Internet domain; and

policies governing access to resources of the Internet domain;

a validation engine configured to perform cross-category consistency validation on at least the domain-related information received by the collection interface, the cross-category consistency validation comprising:

enforcing one or more cross-category consistency rules on at least the domain-related information received by the collection interface, wherein the cross-category consistency rules specify predefined relationships between domain-related information belonging to different categories of the plurality of categories; and

identifying a given item of domain-related information as validated if the given item does not violate any of the one or more cross-category consistency rules; and

a distribution interface configured to distribute, via one or more distribution channels, at least one item of domain-related information identified as validated to requesting parties.

2 . The system of claim 1 , wherein the distribution interface is configured to:

distribute domain-related information via DNS records; and

distribute, via application programming interfaces (APIs), domain-related information with additional metadata.

3 . The system of claim 1 , wherein the one or more cross-category consistency rules comprise a rule specifying that domain-related information for a service of the services provided by the Internet domain is identified as inconsistent if the service references any device that does not belong to the category of devices associated with the Internet domain.

4 . The system of claim 1 , wherein the one or more cross-category consistency rules comprise a rule specifying that domain-related information for a capability of the capabilities offered by the Internet domain is consistent only if at least one policy of the policies governing access to resources of the Internet domain authorizes the capability and the capability does not violate any constraint specified in that policy.

5 . The system of claim 1 , wherein the one or more cross-category consistency rules comprise a rule specifying that domain-related information for an identity of the identities acting on behalf of the Internet domain is consistent only if, for each device of the devices associated with the Internet domain and each service of the services provided by the Internet domain that the identity is configured to operate, the identity is designated as authorized to operate that device or service.

6 . The system of claim 1 further configured to perform cryptographic proof-of-control validation on domain-related information received from at least one automated system.

7 . The system of claim 6 , wherein the cryptographic proof-of-control validation comprises:

issuing a cryptographic challenge to the at least one automated system; and

verifying a signed response from the at least one automated system to the cryptographic challenge using a credential registered with the DA.

8 . The system of claim 1 , wherein the DA further comprises a storage component configured to maintain, for the Internet domain, an authoritative repository of domain-related information that has been identified as validated by the cross-category consistency validation.

9 . The system of claim 8 , wherein at least one of the one or more distribution channels is configured to distribute, to the requesting parties, domain-related information derived at least in part from validated domain-related information stored in the authoritative repository.

10 . The system of claim 1 , wherein the DA implements a chassis-cartridge architecture comprising:

a chassis component configured to provide common services including authentication, DNS integration, and secure storage; and

one or more cartridge components, each cartridge component configured to implement category-specific collection, validation, and distribution logic for one or more of the plurality of categories of domain resources.

11 . The system of claim 1 , wherein the Internet domain is secured using Domain Name System Security Extensions (DNSSEC), and wherein the DA is configured to generate a DNSSEC signature record that cryptographically authenticates the DA locator record.

12 . The system of claim 1 , wherein the DA is further configured to digitally sign a DNS record for at least one subdomain of the Internet domain using a DNSSEC zone-signing key corresponding to the at least one subdomain, wherein services provided by the at least one subdomain are implemented by an external service provider.

13 . The system of claim 12 , wherein the DA is further configured to revoke trust for at least one subdomain of the Internet domain by causing the removal, from an authoritative DNS zone for the Internet domain, of at least one DNSSEC record that forms part of a cryptographic chain of trust for the at least one subdomain.

14 . The system of claim 1 , wherein the DA is configured to:

cause removal or deactivation, in an authoritative DNS zone for the Internet domain, of one or more DNS records that advertise services of the Internet domain; and

distribute, via an API distribution channel, domain-related information to authenticated clients notwithstanding the removal or the deactivation of the one or more DNS records.

15 . The system of claim 1 , wherein the distribution interface is further configured to distribute domain-related information identified as validated to registered callback endpoints via webhook notifications.

16 . The system of claim 1 , wherein the services provided by the Internet domain include a honeypot service, wherein domain-related information associated with the honeypot service identifies the honeypot service as a decoy endpoint, and wherein access requests directed to the decoy endpoint are handled according to a honeypot policy.

17 . The system of claim 2 , wherein the distribution interface further comprises an authenticated access channel configured to provide, to authenticated clients, domain-related information including additional metadata or control operations that are not exposed via non-privileged distribution channels.

18 . The system of claim 1 , wherein the DA is further configured to record telemetry data capturing one or more operations performed by the DA.

19 . A computer-implemented method performed by a Domain Authority (DA) that serves as an authoritative source of domain-related information for an Internet domain, the method comprising:

receiving, via a collection interface of the DA, domain-related information from authorized administrators and automated systems, the domain-related information received by the collection interface belonging to a plurality of categories of domain resources associated with the Internet domain, wherein the plurality of categories comprises at least three of:

devices associated with the Internet domain;

services provided by the Internet domain;

capabilities offered by the Internet domain;

identities acting on behalf of the Internet domain; and

policies governing access to resources of the Internet domain;

performing, via a validation engine of the DA, cross-category consistency validation on at least the domain-related information received by the collection interface, the cross-category consistency validation comprising:

enforcing one or more cross-category consistency rules on at least the domain-related information received by the collection interface, wherein the cross-category consistency rules specify predefined relationships between domain-related information belonging to different categories of the plurality of categories; and

identifying a given item of domain-related information as validated if the given item does not violate any of the one or more cross-category consistency rules; and

distributing, via a distribution interface of the DA, at least one item of domain-related information identified as validated to requesting parties,

wherein the DA is designated by the Internet domain via a Domain Name System (DNS) record stored in at least one authoritative DNS server for the Internet domain, as the authoritative source of domain-related information for the Internet domain, the DNS record comprising a predetermined type indicator identifying the DNS record as a DA locator record and a value identifying a network location for accessing the DA.

20 . A non-transitory computer-readable medium storing program instructions that, when executed by one or more processors of one or more Internet-connected servers, cause the one or more processors to implement a Domain Authority (DA) that serves as an authoritative source of domain-related information for an Internet domain and to:

receive, via a collection interface of the DA, domain-related information from authorized administrators and automated systems, the domain-related information received by the collection interface belonging to a plurality of categories of domain resources associated with the Internet domain, wherein the plurality of categories comprises at least three of:

devices associated with the Internet domain;

services provided by the Internet domain;

capabilities offered by the Internet domain;

identities acting on behalf of the Internet domain; and

policies governing access to resources of the Internet domain;

perform, via a validation engine of the DA, cross-category consistency validation on at least the domain-related information received by the collection interface, the cross-category consistency validation comprising:

enforcing one or more cross-category consistency rules on at least the domain-related information received by the collection interface, wherein the cross-category consistency rules specify predefined relationships between domain-related information belonging to different categories of the plurality of categories; and

identifying a given item of domain-related information as validated if the given item does not violate any of the one or more cross-category consistency rules; and

distribute, via a distribution interface of the DA, at least one item of domain-related information identified as validated to requesting parties,

wherein the DA is designated by the Internet domain via a Domain Name System (DNS) record stored in at least one authoritative DNS server for the Internet domain, as the authoritative source of domain-related information for the Internet domain, the DNS record comprising a predetermined type indicator identifying the DNS record as a DA locator record and a value identifying a network location for accessing the DA.