# dns-caa-via-opendns

> dns-caa-via-opendns is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Retrieves CAA DNS records for a domain as answered by OpenDNS via DNS over HTTPS, including TTL, response code, DNSSEC validation status, and resolver answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/caa/via/opendns?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-caa-via-opendns-bfdd05ff
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8dZp8TKLMk6xDxSY6CVnZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-caa-via-opendns-bfdd05ff
```

Example prompt: Can you look up the CAA records for example.com using the OpenDNS resolver and tell me which certificate authorities are authorized, along with the TTL, response code, and whether DNSSEC was validated?

## When to prefer this

Choose this endpoint when you specifically need CAA records as seen by OpenDNS, for example to compare OpenDNS answers against other resolvers (Cloudflare, Google, NextDNS) to detect split-horizon DNS, filtering, or propagation delays. It is the right choice when diagnosing certificate issuance failures related to CAA policy, auditing DNSSEC validation behavior at OpenDNS, or building multi-resolver DNS comparison workflows.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code with empty records
- OpenDNS resolver fails to answer — returns SERVFAIL response code
- Domain has no CAA records — returns NOERROR with empty record set
- Network timeout reaching OpenDNS DoH endpoint — may return error or timeout
- Invalid or malformed domain name input — may return 400-level error
- Payment not fulfilled — returns 402 Payment Required

## How this service works

CAA records for a domain as answered by OpenDNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the CAA DNS records for the queried domain as seen by OpenDNS, including the raw record values (tag, value, flag), TTL in seconds, DNS response code (NOERROR, NXDOMAIN, SERVFAIL), a flag indicating whether the resolver performed DNSSEC validation, and the resolver's measured answer latency.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-caa-via-opendns-bfdd05ff/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)