# dns-tlsa-via-cleanbrowsing

> dns-tlsa-via-cleanbrowsing is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Fetches TLSA DNS records for a domain using CleanBrowsing's security-filtered DNS over HTTPS resolver, returning records, TTL, response code, DNSSEC validation status, and resolver answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/cleanbrowsing?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-via-cleanbrowsing-b1eb63ba
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_LzHTB2PeFbA8QTn_1CRzS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-via-cleanbrowsing-b1eb63ba
```

Example prompt: Look up the TLSA records for example.com using CleanBrowsing's DNS resolver and tell me the records, TTL, response code, whether DNSSEC was validated, and how fast the resolver responded.

## When to prefer this

Choose this endpoint when you specifically need to see how CleanBrowsing's security-filtered DoH resolver answers TLSA queries — useful for DANE/certificate-pinning validation, detecting resolver-side filtering, or comparing propagation lag between resolvers. Prefer this over generic TLSA lookups when the security-filter behavior or DNSSEC validation status of CleanBrowsing specifically is relevant to your use case.

## Known failure modes

- NXDOMAIN returned if the domain has no TLSA records or does not exist
- SERVFAIL returned if CleanBrowsing cannot resolve the query or DNSSEC validation fails
- CleanBrowsing security filter may block or suppress records it deems malicious, returning filtered results
- Empty record set if TLSA records exist upstream but have not propagated to CleanBrowsing
- Network timeout if CleanBrowsing resolver is temporarily unreachable

## How this service works

TLSA records for a domain as answered by CleanBrowsing (security filter) (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA record set for the queried domain as answered by CleanBrowsing's DoH resolver, including the record data, TTL, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-via-cleanbrowsing-b1eb63ba/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)