# DNS CAA Record Lookup

> DNS CAA Record Lookup is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Looks up DNS CAA records for a domain to identify which certificate authorities are authorized to issue TLS certificates, including issue, issuewild, and iodef directives.

## Facts

- Endpoint: GET https://intel.rallylive.ca/dns/caa
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-record-lookup-0bda2d55
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bLA-boGQNYNZfCpalppE_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-record-lookup-0bda2d55
```

Example prompt: Can you look up the CAA DNS records for example.com and tell me which certificate authorities are authorized to issue TLS certificates for it, including any wildcard or iodef directives?

## When to prefer this

Use this endpoint when you specifically need to audit or troubleshoot TLS certificate authority authorization policies for a domain. It is the right choice when diagnosing certificate issuance failures, verifying CAA policy compliance, or checking wildcard cert permissions — distinct from general DNS lookups (A, TXT records) which are served by sibling endpoints on the same provider.

## Known failure modes

- Domain has no CAA records (returns empty set, not an error — many domains have none)
- Invalid or non-existent domain name returns DNS resolution failure
- Network timeout if DNS resolver is unreachable
- Payment not received results in 402 response blocking the lookup

## How this service works

DNS CAA record lookup: which certificate authorities are allowed to issue TLS certificates for a domain (issue, issuewild, iodef), parsed. Certificate policy audits and issuance troubleshooting. $0.01 per lookup.

## Output

Returns parsed CAA record data for the queried domain, including all issue directives (which CAs may issue standard certificates), issuewild directives (which CAs may issue wildcard certificates), iodef directives (where to report policy violations), TTL values, record count, and any DNSSEC validation status.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-record-lookup-0bda2d55/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)