New DNS convention lets a live domain quietly signal it's for sale

A newly minted informational standard, RFC 10023 (July 2026), reserves a _for-sale DNS leaf node and registers it with IANA so domain owners can advertise that a name is available without disrupting the site running on it. Publishing a TXT record at _for-sale.example.com — starting with the mandatory, case-sensitive version tag v=FORSALE1; and carrying at most one tag/value pair — tells brokers and automated availability services that the domain is negotiable while the homepage keeps serving and mail keeps flowing. This is deliberately the inverse of parking, which swaps the live site for a sales page and costs the owner every remaining visitor.

The convention exists to fill a gap that WHOIS and RDAP never covered: those answer whether a name is registered, not whether its owner would sell, and privacy redaction has largely killed the cold-email path to a registrant. Because a broker or availability service already resolves a name during its checks, one extra lookup surfaces a signal no rendered page can convey, and browsers never see the record at all. The format supports free text (ftxt), a negotiation URI (furi), and an indicative asking price (fval, e.g. USD12500), with strict rules: one pair per record, multiple records per RRset rather than concatenation, a 255-octet single string, and a TTL of 3600 seconds or less so stale offers don’t linger.

The spec is blunt about the security surface. An unsigned TXT record asserting a domain is for sale — with a price and a contact URI — is trivial to forge, so owners are urged to sign the zone with DNSSEC. On the consuming side, ftxt is attacker-controlled text and furi is an attacker-controlled URI; the RFC’s own example payload is a <script> tag, and it warns processors to sanitize before display, treat any advertised price as non-binding, and never auto-navigate to a furi target without explicit user confirmation. Absence of the record is the only way to signal ‘not for sale,’ so owners must remove it once a domain sells or a redemption/pendingDelete period will make the signal vanish on its own.