# dns-caa-via-dnssb

> dns-caa-via-dnssb is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Fetches CAA (Certification Authority Authorization) DNS records for a domain using DNS.SB as the DNS-over-HTTPS resolver, returning records, TTL, response code, DNSSEC validation status, and answer latency.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/caa/via/dnssb?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-via-dnssb-21b23f0d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_WiDNzrno_FjDuKbB41Tvr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-via-dnssb-21b23f0d
```

Example prompt: What CAA records does DNS.SB return for example.com — include the TTL, response code, whether DNSSEC was validated, and how fast the resolver answered?

## When to prefer this

Choose this endpoint when you specifically want to see how DNS.SB resolves CAA records for a domain — useful when comparing resolver behavior, checking for propagation lag to DNS.SB specifically, auditing DNSSEC validation, or detecting split-horizon/filtered DNS responses. Use alongside other resolver-specific endpoints (e.g. AdGuard, Cloudflare, OpenDNS) to compare answers across resolvers.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code
- DNS.SB resolver fails to answer — returns SERVFAIL response code
- No CAA records present for the domain — empty records with NOERROR
- DNSSEC validation failure — indicated in the DNSSEC status field
- Invalid or malformed domain input — request may fail or return an error
- DNS.SB resolver temporarily unreachable — may result in timeout or error

## How this service works

CAA records for a domain as answered by DNS.SB (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the CAA DNS records for the queried domain as answered by DNS.SB, including the record values (tag, value, flags), TTL, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), whether the resolver performed DNSSEC validation, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-via-dnssb-21b23f0d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)