# DNS Subdomain Discovery API

> DNS Subdomain Discovery API is a paid API for AI agents from dns.payapi.market, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-17).

Enumerates subdomains for a given apex domain using Certificate Transparency logs (crt.sh)

## Facts

- Endpoint: POST https://dns.payapi.market/dns/subdomains?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-subdomain-discovery-api-313fd4fb
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_x5y4LRv52Lgb_RDmI7zBO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-subdomain-discovery-api-313fd4fb -d '<json body>'
```

Example prompt: Can you find all the subdomains of stripe.com using Certificate Transparency logs — return up to 500 results?

## When to prefer this

Choose this endpoint when you need passive subdomain discovery sourced from Certificate Transparency logs without active scanning — ideal for security research, asset inventory, and reconnaissance where stealth matters. Prefer it over active DNS brute-force tools when you want a quick, non-intrusive snapshot of a domain's known subdomains.

## Known failure modes

- Invalid or non-existent domain returns empty subdomain list
- Domain with no CT log entries returns zero results
- Limit parameter out of range (below 1 or above 1000) causes validation error
- Network timeout if crt.sh is slow or unavailable
- Payment failure via x402 if insufficient USDC balance

## How this service works

DNS records, WHOIS, SSL certificate, subdomain discovery, and reverse-IP lookup with x402 payments.

## Output

Returns a JSON object containing the queried apex domain, the data source (crt.sh Certificate Transparency logs), a list of discovered subdomains, the count of returned subdomains, and the total unique subdomain count.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "limit": {
   "type": "integer",
   "maximum": 1000,
   "minimum": 1,
   "description": "Maximum number of subdomains to return. Defaults to 200."
  },
  "domain": {
   "type": "string",
   "description": "Apex domain to enumerate subdomains for via Certificate Transparency logs, e.g. 'example.com'."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 3,
  "domain": "example.com",
  "source": "crt.sh (Certificate Transparency logs)",
  "subdomains": [
   "api.example.com",
   "mail.example.com",
   "www.example.com"
  ],
  "total_unique": 3
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-subdomain-discovery-api-313fd4fb/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.payapi.market](https://www.zero.xyz/host/dns.payapi.market/llms.txt)