Playground
The life of a name.
In DNX a name is not a label that gets translated into an address — it is the address, the unit of trust, and the thing routing tables aggregate on. That is easier to show than to argue. Type a name below and follow it: which registry is authoritative for it and how a resolver finds that out, what identifier that registry allocates and signs, how routers forward it reading one level at a time, and what it costs on the wire. Every rule on this page is a faithful port of the deployed Go — including the ones that refuse.
Who is allowed to answer for it?
A resolver starts knowing exactly one thing: the address and signing key of the registry it was configured with. Everything else it learns by being told, and every telling is a signed referral it must decide whether to believe. Three conditions have to hold at each hop, and all three are checked when the referral arrives — checking them where the referral is issued protects an honest operator from a typo, but an attacker does not issue referrals from your config file.
What number does it get, and who says so?
The authoritative registry assigns an identifier when it binds the name. Each level only has to be unique among its siblings, which is what keeps the numbers small — and small numbers are only meaningful if everyone agrees on them, so the registry publishes what it allocated under its own signature. Levels above the registry's own zone were not chosen by it: those came with the delegation, granted by the parent that handed the branch over.
Build the hierarchy yourself.
This is the part worth playing with. The namespace, the trust chain, and the allocation scheme are not three systems that cooperate — they are one hierarchy seen from three angles, and the only way to feel that is to extend it and try to break it. Delegate a zone and watch a new registry appear with a granted prefix it did not choose. Register a host and watch its number come from whichever registry is authoritative. Then use the red buttons: they are the attacks the delegation rules exist to stop, and each one names the rule that catches it.
How it crosses the network.
Now the name is a path, and routing is almost boring — which is the point. Each router reads the one level it owns, looks it up, forwards, and never looks lower. Nothing reads the whole destination; nothing opens the payload, which was sealed before the routing header was attached. This walks the same four-router topology running across two datacenters right now.
This is a faithful simulation in your browser. To watch actual packets cross two physical machines with telemetry streamed back from both, use the live routing demo.
What actually gets sent.
One length byte, one 32-bit identifier per level, a counter of how much has been resolved, and the sealed payload. No addresses appear anywhere, because there are none — the name is the destination, all the way down to the bytes.
Why the core never grows.
The claim the whole design rests on: adding hosts must not enlarge the tables near the root. Drag it and watch. The leaf switch learns every host because that is the level where the distinction lives; the core learns nothing, because it already knows where .com is and has never been asked anything else.
Footnote: the format this one replaced
DNX originally carried a fixed 256-bit destination: four 64-bit fields — TLD, domain, subdomain, host — with the top two assigned by a registry and the bottom two derived by hashing the label. Hashing meant no coordination at all: every machine computed the same value for the same label, with nobody to ask. That property is what the 32 bytes bought.
It had a wall at four labels, and for a while it hit that wall silently: a deeper name was encoded with its middle labels simply dropped, so node1.accounting.us.dnx.dnxroute.com and node1.payroll.eu.dnx.dnxroute.com produced one identical address with no error anywhere. That was defect 10, and it was found by someone asking whether a six-label name would work.
The format is retired. Both encodings ran concurrently on the same routers with no cutover; the registry then became the identifier authority, which removed the fixed address's last reason to exist; then it was deleted. A router asked for one today refuses it by name rather than shrugging at an unrecognised marker, because an operator can act on a retirement notice and cannot act on silence. The whitepaper records the sequence — it is the only proof the protocol has that it can be deployed incrementally.