# DNS CAA Policy Check

> DNS CAA Policy Check is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Checks whether a certificate authority identifier is permitted by DNS CAA records, returning a deterministic pass/advisory verdict as structured JSON.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/dns-caa-policy-check
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-policy-check-06741952
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XzfxhmY6RiIaOoJ__kU4K

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-policy-check-06741952 -d '<json body>'
```

Example prompt: Check whether the certificate authority 'letsencrypt.org' is permitted by these CAA records before we accept this TLS certificate — run a DNS CAA policy check and tell me if it passes or gets an advisory flag.

## When to prefer this

Prefer this endpoint when you need a fast, deterministic, serverless CAA policy check without relying on live DNS resolution — it evaluates caller-supplied records and issuer in-memory, making it ideal for pre-issuance validation pipelines, caching decisions, or security audits where you already have the CAA records and want a structured, versioned verdict without external DNS dependencies.

## Known failure modes

- Malformed issuer string causes validation error
- Records array exceeds 256-item limit returns error
- Individual record objects exceeding 128-property limit rejected
- Missing required fields returns 400-level error
- Ambiguous or empty issuer may produce advisory rather than pass

## How this service works

DNS Caa Policy Check: DNS Caa Policy Check checks whether a certificate authority identifier is allowed by CAA records from bounded caller-supplied values without an external provider. Call DNS Caa Policy Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for DNS Caa Policy Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, s…

## Output

Returns versioned deterministic JSON containing: normalized CAA record evidence, the computed policy finding, and an explicit pass or advisory status indicating whether the supplied issuer identifier is authorized by the provided CAA records.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "issuer": {
   "type": "string",
   "maxLength": 8192,
   "description": "Issuer supplied to DNS Caa Policy Check; used only for this bounded calculation and processed in memory without retention."
  },
  "records": {
   "type": "array",
   "items": {
    "type": "object",
    "maxProperties": 128,
    "additionalProperties": true
   },
   "maxItems": 256,
   "description": "Records supplied to DNS Caa Policy Check; used only for this bounded calculation and processed in memory without retention."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "issuer": "letsencrypt.org",
   "permitted": true
  },
  "schema": "delx/util-dns-caa-policy-check/v1",
  "status": "pass",
  "evidence": {
   "retained": false,
   "input_sha256": "b0ce3b06dcfb1237aa32eef6c1398ecd3e5f4811ddf5558614373560166e3b1e",
   "external_calls": 0
  },
  "operation": "web_reliability:dns_caa_policy_check"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-policy-check-06741952/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)