# dns-caa-via-google

> dns-caa-via-google is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Retrieves CAA (Certification Authority Authorization) DNS records for a domain as resolved by Google's 8.8.8.8 DNS over HTTPS resolver, including TTL, response code, DNSSEC validation status, and answer latency.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/caa/via/google?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-via-google-eecfa78e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ErZzutne1Ea1eUB1IDCD_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-via-google-eecfa78e
```

Example prompt: Can you look up the CAA records for example.com using Google's 8.8.8.8 resolver and tell me which certificate authorities are authorized, the TTL, and whether DNSSEC was validated?

## When to prefer this

Choose this endpoint when you specifically need to see CAA records as resolved by Google's 8.8.8.8 resolver, for example to verify certificate authority authorizations from Google's perspective, to diagnose CA issuance failures, or to compare propagation between resolvers. Use it over generic DNS tools when you need Google-specific resolution behavior, DNSSEC validation status, and resolver latency in a single paid API call.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code with empty records
- Domain has no CAA records — returns NOERROR with empty record set
- DNS resolution failure at Google resolver — returns SERVFAIL
- Invalid or malformed domain name input — may return error or SERVFAIL
- Google resolver temporarily unavailable — service error response
- DNSSEC validation failure — resolver may return SERVFAIL with DNSSEC flag false

## How this service works

CAA records for a domain as answered by Google 8.8.8.8 (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the CAA records for the queried domain as answered by Google's 8.8.8.8 DNS over HTTPS resolver, including the record values (tag, value, flags), TTL in seconds, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), a boolean indicating whether the resolver validated DNSSEC, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-via-google-eecfa78e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)