# DNS CAA Records via CleanBrowsing

> DNS CAA Records via CleanBrowsing is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Resolves CAA (Certification Authority Authorization) DNS records for a domain using CleanBrowsing's security-filtered DNS over HTTPS resolver, returning records, TTL, response code, DNSSEC validation status, and answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/caa/via/cleanbrowsing?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-records-via-cleanbrowsing-1d48521b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Qkrl8mx3ttheMYIT-Jh39

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-records-via-cleanbrowsing-1d48521b
```

Example prompt: What CAA records does CleanBrowsing's DNS resolver return for example.com — show me the records, TTL, response code, and whether DNSSEC was validated?

## When to prefer this

Choose this endpoint when you specifically want to see CAA records as resolved by CleanBrowsing's security-filtered DNS over HTTPS resolver — useful for comparing resolver behavior, detecting propagation lag, investigating split-horizon DNS, or auditing whether a security-filtering resolver returns the same CAA data as authoritative or other resolvers. Prefer this over generic CAA lookups when CleanBrowsing's filtering behavior or DNSSEC validation status is relevant to your investigation.

## Known failure modes

- Domain does not exist — NXDOMAIN response code returned
- CleanBrowsing resolver is temporarily unavailable — SERVFAIL response
- Domain has no CAA records — empty record set with NOERROR
- CleanBrowsing security filter blocks or alters the response — filtered or redirected answer
- DNSSEC validation failure — resolver returns SERVFAIL due to DNSSEC mismatch
- Invalid domain format in query — malformed request error
- Network timeout reaching the CleanBrowsing DoH endpoint — elevated answer time or error

## How this service works

CAA records for a domain as answered by CleanBrowsing (security filter) (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the CAA DNS records for the queried domain as answered by CleanBrowsing's security-filtered DoH resolver, including: the record values (issuer tags and domains), TTL, the DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), a flag indicating whether the resolver validated DNSSEC, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-records-via-cleanbrowsing-1d48521b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)