# CAA Record Lookup for Domain

> CAA Record Lookup for Domain is a paid API for AI agents from domain-dns.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-25).

Retrieves CAA (Certification Authority Authorization) DNS records for a domain, walking up to parent names, to show which CAs may issue certificates, wildcard rules, and reporting contacts.

## Facts

- Endpoint: GET https://domain-dns.x402tookit.com/caa-check?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/caa-record-lookup-for-domain-8a9afe48
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_J9eihJMLNE86i-cPjsNK-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability caa-record-lookup-for-domain-8a9afe48
```

Example prompt: Can you check the CAA records for cloudflare.com and tell me which certificate authorities are allowed to issue SSL certificates for it, including any wildcard rules?

## When to prefer this

Choose this endpoint when you specifically need CAA DNS record data for a domain, including parent-level inheritance, wildcard issuance rules, and iodef contacts. It is ideal for pre-certificate-issuance checks, PKI security audits, or diagnosing CA authorization failures. Prefer it over a generic DNS lookup when you need the CAA-specific parsed output (allowed issuers, wildcard issuers, verdict) rather than raw record text.

## Known failure modes

- Domain does not exist or has no DNS records — returns empty or null records with an explanatory verdict
- Network or resolver timeout — may return degraded=true with partial data
- Invalid domain input (malformed string) — likely returns an error or empty result
- Domain has no CAA records at any level — returns empty allowedIssuers with summary indicating no restriction
- Rate limiting or payment failure — 402 response requiring valid x402 payment

## How this service works

CAA records for a domain (walking up to parent names): which CAs may issue certificates, wildcard rules and reporting contacts.

## Output

Returns a structured object including the list of allowed certificate issuers, allowed wildcard issuers, iodef reporting contacts, individual CAA record entries (tag, flag, value), the domain level where the records were found (foundAt), a human-readable summary and verdict, a degraded flag if data quality is uncertain, the source/resolver used, and a timestamp (asOf).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain name, e.g. cloudflare.com"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "iodef": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "domain": {
       "type": [
        "null",
        "string"
       ]
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "foundAt": {
       "type": [
        "null",
        "string"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "records": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "object",
        "properties": {
         "tag": {
          "type": [
           "null",
           "string"
          ]
         },
         "flag": {
          "type": [
           "null",
           "number"
          ]
         },
         "value": {
          "type": [
           "null",
           "string"
          ]
         }
        }
       }
      },
      "summary": {
       "type": [
        "null",
        "string"
       ]
      },
      "verdict": {
       "type": [
        "null",
        "string"
       ]
      },
      "degraded": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "sourceUrl": {
       "type": [
        "null",
        "string"
       ]
      },
      "disclaimer": {
       "type": [
        "null",
        "string"
       ]
      },
      "notChecked": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/caa-record-lookup-for-domain-8a9afe48/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from domain-dns.x402tookit.com](https://www.zero.xyz/host/domain-dns.x402tookit.com/llms.txt)