# dns-tlsa-via-google

> dns-tlsa-via-google is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Retrieves TLSA DNS records for a domain using Google's 8.8.8.8 resolver via DNS over HTTPS, returning records, TTL, response code, DNSSEC validation status, and answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/google?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-via-google-56f90610
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_a4VWNVViTbyAU0GHFsNLj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-via-google-56f90610
```

Example prompt: What TLSA records does Google's 8.8.8.8 DNS resolver return for example.com, and did it validate DNSSEC?

## When to prefer this

Choose this endpoint when you specifically need to see how Google's public 8.8.8.8 resolver answers TLSA queries, particularly for diagnosing DANE/TLS certificate association issues, checking DNSSEC validation on Google DNS, or comparing Google's response against other resolvers to detect propagation lag or split-horizon DNS differences.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code
- No TLSA records published for the domain — returns NOERROR with empty answer section
- DNSSEC validation failure — returns SERVFAIL with AD flag false
- Resolver unreachable — request timeout or HTTP error
- Missing required domain query parameter — API returns an error

## How this service works

TLSA records for a domain as answered by Google 8.8.8.8 (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA record set (certificate association data) for the queried domain as resolved by Google's 8.8.8.8 DoH resolver, along with the TTL, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), whether DNSSEC validation was performed, and the resolver's answer latency.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-via-google-56f90610/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)