# DNS TLSA Lookup via DNS.SB (DoH)

> DNS TLSA Lookup via DNS.SB (DoH) is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Retrieves TLSA DNS records for a domain using DNS.SB as the DNS-over-HTTPS resolver, returning records, TTL, response code, DNSSEC validation status, and answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/dnssb?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-lookup-via-dns-sb-doh-7a27afc6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_c1_ooDZR80yuA47TXGfdr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-lookup-via-dns-sb-doh-7a27afc6
```

Example prompt: Look up the TLSA records for example.com using DNS.SB as the resolver and tell me the TTL, whether DNSSEC was validated, and how fast DNS.SB answered.

## When to prefer this

Choose this endpoint when you specifically need TLSA (DANE) records as resolved by the DNS.SB public DoH resolver, particularly when comparing resolver behavior, checking propagation to DNS.SB, investigating DNSSEC validation, or auditing split-horizon or filtering differences between resolvers. Use sibling endpoints for other DNS record types or other resolvers.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code with empty records
- No TLSA record configured for domain — returns NOERROR with empty answer section
- Resolver-side failure — returns SERVFAIL response code
- DNSSEC validation failure — DNSSEC flag may be false even when records exist
- Network timeout to DNS.SB resolver — may return error or delayed response

## How this service works

TLSA records for a domain as answered by DNS.SB (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA DNS records for the queried domain as answered by DNS.SB, including: the record data itself, TTL value, response code (NOERROR, NXDOMAIN, or SERVFAIL), a flag indicating whether DNSSEC was validated by the resolver, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-lookup-via-dns-sb-doh-7a27afc6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)