# dns-tlsa-via-adguard

> dns-tlsa-via-adguard is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Retrieves TLSA DNS records for a domain via AdGuard DNS-over-HTTPS, returning records, TTL, response code, DNSSEC validation status, and resolver answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/adguard?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-via-adguard-5f38eca1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dj0zgQps70cCpC4r1P3VL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-via-adguard-5f38eca1
```

Example prompt: Can you look up the TLSA records for mail.example.com using AdGuard DNS and tell me what records come back, the TTL, whether DNSSEC was validated, and how fast the resolver responded?

## When to prefer this

Choose this endpoint when you specifically need to query TLSA (DANE) records as seen from AdGuard DNS over HTTPS, particularly to audit DANE/TLS certificate pinning, compare AdGuard's answers against other resolvers for propagation or filtering analysis, or verify DNSSEC validation behavior for TLSA records on AdGuard's resolver.

## Known failure modes

- NXDOMAIN returned if the domain or TLSA record does not exist
- SERVFAIL returned if the domain is unreachable or DNSSEC validation fails
- Empty record set if no TLSA records are published for the queried domain
- AdGuard may filter or block certain domains, returning unexpected response codes
- Network timeout or slow response if AdGuard DNS is temporarily degraded

## How this service works

TLSA records for a domain as answered by AdGuard DNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA record set (record values and parameters), TTL, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), a flag indicating whether AdGuard validated DNSSEC, and the resolver's answer time in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-via-adguard-5f38eca1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)