# DNS Health Check

> DNS Health Check is a paid API for AI agents from agent-data.centorprat.workers.dev, paid per call via x402, $0.015/call, status unknown (last checked 2026-10-29).

Resolves core DNS records for given domains via DoH and runs best-practice checks (DNSSEC, CAA, IPv6, SPF/DMARC, nameserver diversity) returning a structured health signal with findings

## Facts

- Endpoint: POST https://agent-data.centorprat.workers.dev/tools/dns-health-check?utm_source=zero.xyz
- Price: $0.015/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-health-check-83659b48
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hl0HQqlE8UfWRcVwtPFFp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-health-check-83659b48 -d '<json body>'
```

Example prompt: Can you run a DNS health check on example.com and mybrand.org — I want to know if they have DNSSEC, SPF, DMARC, CAA records, IPv6 support, and enough diverse nameservers?

## When to prefer this

Choose this endpoint when you need a quick, read-only, multi-check DNS health audit across up to 3 domains in a single call without needing to set up your own DNS resolver toolchain. It is ideal for pre-launch audits, email deliverability checks, compliance monitoring, and agent-driven alerting workflows. Prefer this over generic DNS lookup tools when you want best-practice analysis (DNSSEC, CAA, SPF, DMARC, IPv6, nameserver diversity) rather than raw record data.

## Known failure modes

- Domain does not resolve at all — returned as a finding, not charged
- Invalid domain format in input — may return error or empty result
- DoH upstream timeout — transient failure for that domain
- All 3 domain slots used but some DNS lookups fail — failed lookups not billed
- DNSSEC validation inconclusive due to upstream resolver state

## How this service works

Pay-per-call data and tools for AI agents, $0.002-0.01 per call in USDC via x402 (Base, Polygon or Solana), no account or API key; MAX tiers ($0.05-0.25) run deeper jobs. Agent toolkit: web search, search + read top pages, any page as clean markdown with a prompt-injection check, which-x402-API-to-call recommender, seller check. Data: Google Maps places with contacts, YouTube video data and transcripts, job listings (Indeed, LinkedIn, 13 boards), Google Ads Transparency, TikTok comments, Pinterest, Airbnb, Redfin, AliExpress, app stores, live sports, website and SEO checks, Shopify store tech stacks, and onchain token / address risk checks.

## Output

Returns a per-domain health report including: whether the domain resolves, nameserver count and diversity assessment, DNSSEC validation status, presence/absence of CAA records, IPv6 support, SPF and DMARC record presence, and a list of specific findings or best-practice violations. An overall health signal (healthy or not) is provided for each domain, enabling quick triage.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domains": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 3,
   "description": "Domains to check, e.g. [\"example.com\", \"your-brand.org\"]. One health report per domain."
  },
  "onlyProblems": {
   "type": "boolean",
   "description": "On: return only domains that aren't fully healthy (ideal for scheduled alerting)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "note": "Read-only public DNS over DoH; never contacts the domain's servers. Recommendations, not a verdict.",
    "score": "6/8",
    "checks": [
     {
      "check": "resolves",
      "detail": "Resolves to 2 IPv4 + 0 IPv6 address(es).",
      "status": "pass"
     },
     {
      "check": "ipv6",
      "detail": "No IPv6 (AAAA) record.",
      "status": "warn"
     },
     {
      "check": "nameservers",
      "detail": "4 nameservers across 4 provider(s).",
      "status": "pass"
     },
     {
      "check": "dnssec",
      "detail": "DNSSEC not enabled.",
      "status": "warn"
     },
     {
      "check": "caa",
      "detail": "CAA record restricts which CAs can issue certs.",
      "status": "pass"
     },
     {
      "check": "soa",
      "detail": "SOA present.",
      "status": "pass"
     },
     {
      "check": "spf",
      "detail": "SPF present.",
      "status": "pass"
     },
     {
      "check": "dmarc",
      "detail": "DMARC present.",
      "status": "pass"
     }
    ],
    "domain": "stripe.com",
    "passed": 6,
    "signal": "ok-with-recommendations",
    "records": {
     "a": [
      "198.137.150.111",
      "198.202.176.111"
     ],
     "mx": [
      "30 aspmx2.googlemail.com.",
      "30 aspmx3.googlemail.com.",
      "20 alt2.aspmx.l.google.com.",
      "10 aspmx.l.google.com.",
      "20 alt1.aspmx.l.google.com."
     ],
     "ns": [
      "ns-423.awsdns-52.com.",
      "ns-1087.awsdns-07.org.",
      "ns-1882.awsdns-43.co.uk.",
      "ns-705.awsdns-24.net."
     ],
     "caa": [
      "0 issue \"amazon.com\"",
      "0 iodef \"mailto:caa-violations@stripe.com\"",
      "0 issue \"visa.com\"",
      "0 issue \"digicert.com\""
     ],
     "spf": true,
     "aaaa": [],
     "dmarc": true,
     "dnssec": false,
     "hasMail": true
    },
    "failures": 0,
    "findings": [
     "No IPv6 (AAAA) record.",
     "DNSSEC not enabled."
    ],
    "warnings": 2,
    "checkedAt": "2026-10-23T11:31:45+00:00"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-health-check-83659b48/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-data.centorprat.workers.dev](https://www.zero.xyz/host/agent-data.centorprat.workers.dev/llms.txt)