# dns-tlsa-via-mullvad

> dns-tlsa-via-mullvad is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-20).

Fetches TLSA DNS records for a domain using Mullvad's DNS over HTTPS resolver, returning records, TTL, response code, DNSSEC validation status, and answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/mullvad?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-via-mullvad-91947cba
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_X86W2c6tL03hkEMYb5AHs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-via-mullvad-91947cba
```

Example prompt: What TLSA records does Mullvad DNS return for example.com, and does it validate DNSSEC for them?

## When to prefer this

Choose this endpoint when you specifically need to see how Mullvad's privacy-focused DNS resolver answers TLSA queries, particularly for DANE/SMTP certificate pinning checks, DNSSEC validation auditing, or multi-resolver propagation comparisons. Useful when Mullvad's resolver characteristics (privacy-oriented, potentially different filtering) are relevant to the diagnostic task.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code with no records
- No TLSA records for domain — NOERROR with empty record set
- Resolver fails to answer — SERVFAIL response
- Network timeout reaching Mullvad resolver — possible latency spike or unavailability
- Invalid domain format provided — likely an input validation error
- Mullvad resolver filters or blocks the query — may manifest as SERVFAIL or empty response

## How this service works

TLSA records for a domain as answered by Mullvad DNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA records (if any) for the queried domain as seen by the Mullvad DNS over HTTPS resolver, along with the TTL, DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), whether the resolver performed DNSSEC validation, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-via-mullvad-91947cba/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)