We introduce Self-Authenticating Traditional (SAT)domain names. SAT domains are traditional recognizable domains resolvable via the Domain Name System (DNS). Theyare also self-authenticating—they encode in the name itself apublic key for authenticating the SAT domain. We presentan implementation of our SAT domains for servers and acorresponding Firefox WebExtension that validates connectionsto them.SAT domains weave security directly into the fabric of theWeb by building authentication into URLs themselves. Thus, bysimply posting links to other SAT domains, a SAT site that a usertrusts assures that user of the ability to make hijack-resistantconnections to any of those domains. Because just the addressattested in this way is sufficient for users to create a secureconnection to a recognizable domain, we call this dirt simpletrust. We present implemented examples of this and describeother channels to establish dirt simple trust.The public keys we embed in SAT domain names are in theformat of Tor onion service keys. Specifically, a SAT domainincludes the encoding of an onion service public key as asubdomain of a registered domain name. But the client canbe ignorant of Tor and need not direct traffic over any onionrouting network to obtain our protections. This makes SATdomains compatible with other browsers and standard routinginfrastructure. Nonetheless, our extension also works in TorBrowser.We also explore systems developed and deployed by othersthat associate a self-authenticating domain with a traditional DNSdomain using existing Web authentication mechanisms, but without building security in directly. Recently, major providers havedeployed .onion alternative services to support load balancingand improved performance for Tor users. Though superficiallysimilar to SAT domains, our analysis indicates that these alternative services are not actually self-authenticating. They alsoincrease the effectiveness and impact of client tracking attacksacknowledged in the design of alternative services. We describesuch attacks and describe another benefit of our WebExtension:it provides an interface allowing users to selectively block orpermit alternative services.