Bob Docs

Send HNS with a wallet alias

A wallet alias lets you enter a memorable hostname such as @pay.example instead of pasting a Handshake address. Bob resolves the address and verifies the result before enabling the payment.

Bob LearnHNS 2.3.1 notice: this version can send alias lookups to the wrong local DNS port. Update to Bob LearnHNS 2.3.2 for the permanent fix. Until you update, open Settings and set Alias Resolver to 10892, then return to Send. Reinstalling 2.3.1 does not fix the issue.

Using an alias

Open Send and select Send HNS.
Enter the complete alias, including its leading @.
Paste the alias, press Enter, select Resolve alias, or leave the field after typing it to start resolution.
Wait for Bob to show the resolved HNS address and lock indicator.
Check the hostname and resolved address before continuing. A familiar alias is not a substitute for reviewing the payment.

How Bob verifies it

Bob removes the UI-only @, requests https://hostname/.well-known/wallets/HNS, and queries the TLSA record at _443._tcp.hostname. It accepts the returned HNS address only when the TLS certificate passes DANE verification and the address is valid for the active network.

If HIP-2 fails, Bob independently looks for a TXT record on the exact same hostname beginning with hns: or hns=. Bob accepts this result only when the DNS response is authenticated with Handshake/DNSSEC and the address is valid for the active network.

Two independent security methods: HIP-2 hosting requires a matching TLSA record. An authenticated HNS TXT wallet record uses no HTTPS hosting and therefore requires no TLSA record. Bob still rejects unauthenticated, malformed, wrong-network, or ambiguous TXT values.

Understanding error messages

The alias certificate does not match its TLSA record: The alias owner must fix HIP-2. The certificate users receive does not match the published TLSA record. Bob can still use a separately authenticated HNS TXT wallet record if one is published; otherwise, do not send.
The alias TXT fallback is not authenticated by DNSSEC: The alias owner must fix this. Bob found a TXT fallback but could not authenticate it. Do not send until DNSSEC validation succeeds.
No secure HNS address is published for this alias: The alias owner must fix this. The hostname has neither a usable HIP-2 response nor an authenticated hns:/hns= TXT record.
The alias returned an invalid or multiple HNS addresses: The alias owner must fix this. The published value is malformed, belongs to another network, is too large, or contains conflicting addresses.
Enter a complete alias beginning with @: You can fix this. Use the complete hostname, such as @pay.example. Without @, Bob treats the entry as a literal HNS payment address.
Could not reach the alias host: You may be able to fix this. Check the spelling and internet connection, then try again. If only Bob LearnHNS 2.3.1 fails, use the resolver-port workaround above.
Alias DNS lookup failed: Check Bob first. Confirm Bob is synchronized, DNS is enabled, and the Alias Resolver in Settings matches Bob's recursive DNS port. Otherwise, retry later or contact support.

Operator setup checklist

Serve one plain HNS address from /.well-known/wallets/HNS over HTTPS.
Publish a DNSSEC-authenticated TLSA record at _443._tcp.your-hostname that matches the certificate users actually receive.
For a hosting-independent wallet record, publish one valid TXT value such as hns:hs1… or hns=hs1… and ensure Handshake/DNSSEC validation succeeds. This method does not require TLSA.
Test from outside your hosting network and against every edge address or CDN region that may serve the hostname.
Monitor certificate renewal and key rotation. CDN-managed certificates can change, so TLSA maintenance may need automation or a stable-key certificate strategy.

Example checks:

dig +dnssec _443._tcp.your-hostname TLSA
dig +dnssec your-hostname TXT
curl https://your-hostname/.well-known/wallets/HNS

Privacy and support

Resolving an alias makes DNS and HTTPS requests for its hostname, which can reveal that the hostname was queried. Bob does not send your seed phrase, private keys, wallet password, or payment amount to the alias host.

Current patch builds print privacy-safe terminal lines such as [Bob action] Hip2.fetchAddress failed [ETLSAMISMATCH]. These show the operation and result without printing the alias hostname, resolved address, amount, password, seed, or transaction payload. The terminal also shows Bob's active local Alias Resolver port.

If an alias fails, capture the exact on-screen error and the matching safe terminal action line, then use the Bob support channels without sharing wallet secrets.