# dns-caa-via-nextdns

> dns-caa-via-nextdns is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Retrieves CAA (Certification Authority Authorization) DNS records for a domain as answered by the NextDNS resolver via DNS over HTTPS, including records, TTL, response code, DNSSEC validation status, and answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/caa/via/nextdns?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-via-nextdns-566853c2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y3jAsqc9Mr4C0YsnW7qIW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-via-nextdns-566853c2
```

Example prompt: What CAA records does NextDNS return for example.com, and does it validate DNSSEC for them?

## When to prefer this

Choose this endpoint when you specifically need to see how NextDNS resolves CAA records for a domain — particularly useful for comparing resolver behavior, detecting propagation lag, identifying filtering differences, or confirming DNSSEC validation status from NextDNS's perspective. Use alongside sibling resolvers (e.g., AdGuard, Cloudflare) to spot split-horizon or resolver-specific discrepancies.

## Known failure modes

- NXDOMAIN returned if the domain does not exist
- SERVFAIL if the upstream resolver or domain is unreachable
- Empty records array if no CAA records are published for the domain
- DNSSEC validation failure indicated in response if domain has broken DNSSEC chain
- Network timeout if NextDNS is temporarily unavailable

## How this service works

CAA records for a domain as answered by NextDNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the CAA DNS records for the queried domain as answered by NextDNS, including the record values, TTL, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), whether DNSSEC was validated, and the resolver's answer latency.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-via-nextdns-566853c2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)