# dns-caa-via-cloudflare

> dns-caa-via-cloudflare is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Looks up CAA (Certification Authority Authorization) DNS records for a domain using Cloudflare 1.1.1.1 DNS over HTTPS, returning records, TTL, response code, DNSSEC validation status, and resolver answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/caa/via/cloudflare?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-via-cloudflare-bae8edea
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zmxC3bwZ8iDed-AlHTX6H

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-via-cloudflare-bae8edea
```

Example prompt: Can you check the CAA records for example.com as seen by Cloudflare's 1.1.1.1 resolver and tell me which certificate authorities are authorized, the TTL, whether DNSSEC was validated, and how fast the resolver responded?

## When to prefer this

Choose this endpoint when you need to specifically see how Cloudflare's 1.1.1.1 resolver answers CAA queries — particularly useful for comparing against other resolvers (DNSPod, NextDNS, Mullvad, DNS.SB) available on the same platform to spot propagation lag, split-horizon DNS, or resolver-level filtering. Prefer it over raw DNS tools when you also need DNSSEC validation status and resolver latency in a single structured response.

## Known failure modes

- NXDOMAIN response if the domain does not exist
- SERVFAIL if the authoritative nameserver is unreachable or misconfigured
- Empty record set with NOERROR if no CAA records are published for the domain
- DNSSEC validation failure if the domain has broken DNSSEC configuration
- Request failure if the domain query parameter is missing or malformed
- Payment failure if insufficient USDC balance for the $0.01 per-call fee

## How this service works

CAA records for a domain as answered by Cloudflare 1.1.1.1 (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the CAA records (including flags, tag, and value for each record), the TTL, the DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), a boolean indicating whether Cloudflare validated DNSSEC for the response, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-via-cloudflare-bae8edea/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)