Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

DNS auth 401 "no MCP public key found" despite correct, globally-propagated base64 TXT record

Open
  • Is something wrong?
#1,694 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 5 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
authentication, networking

Research direction

Start with the registry's DNS authentication path, using the mcp-publisher login dns flow and the reported 401 as the reproduction. Compare the TXT lookup result used by the registry with the public and authoritative resolver results listed here, and investigate whether stale negative caching is involved. Done means the registry recognizes the published base64 proof and DNS login succeeds, or the resolver/cache behavior is identified.

Written by the indexing model from the issue text.

Description

Summary

DNS authentication (mcp-publisher login dns) fails with 401 no MCP public key found in DNS TXT records, even though the required MCP proof TXT record is correctly published, well-formed, and globally propagated. The registry's resolver appears to be serving/caching a stale negative result: every public resolver and the authoritative nameserver return the correct base64 Ed25519 key, but the registry still cannot see it after ~3 hours.

Environment
  • mcp-publisher version: 1.8.1
  • Domain: solides.com.br (apex TXT record, authoritative = AWS Route 53, TTL 60s)
  • Auth method: login dns
What the publisher expects (from login dns output)
Expected proof record:
v=MCPv1; k=ed25519; p=SKhuBvoz+KAh+PdxO6WHDunygJ03s6ahwSbR6FR3wtw=
What is actually published (and globally propagated)

The TXT record on the solides.com.br apex is identical to the expected proof, is a single value (no 255-char chunking, no duplicate v=MCPv1), with TTL 60s. Verified just now against 5 resolvers plus the authoritative NS:

Resolver Returns
8.8.8.8 (Google) v=MCPv1; k=ed25519; p=SKhuBvoz+KAh+PdxO6WHDunygJ03s6ahwSbR6FR3wtw=
1.1.1.1 (Cloudflare) identical
9.9.9.9 (Quad9) identical
208.67.222.222 (OpenDNS) identical
ns-1666.awsdns-16.co.uk (authoritative Route 53) identical

Reproduce:

dig +short TXT solides.com.br @8.8.8.8 | grep MCPv1
Actual error
Error: failed to get token: failed to exchange dns signature: token exchange failed with status 401:
{"title":"Unauthorized","status":401,"detail":"DNS authentication failed",
 "errors":[{"message":"no MCP public key found in DNS TXT records"}]}
Likely cause

The record was previously published for a few days in hex encoding (p=48a8..., 64 chars) before being corrected to the spec-required base64 encoding. We suspect the registry's internal DNS resolver has a stale cache / negative-cache entry for solides.com.br TXT that is outliving the record's 60s TTL (3h+ and counting), so it never re-fetches the corrected base64 key. The public internet has fully converged on the correct value.

Ask

Could you confirm which resolver the registry backend uses for DNS auth, and whether its cache for solides.com.br TXT can be flushed / its TTL honored? Happy to provide any further diagnostics.

(Note: the p= value above is an Ed25519 public key — safe to share for reproduction.)

Dominant language
Go
Stars
7.3k
Forks
1k
Avg merge
4d 4h
Merged PRs (30d)
13

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/registry

All issues in modelcontextprotocol/registry

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.