# dns-tlsa-via-nextdns

> dns-tlsa-via-nextdns is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-22).

Fetches TLSA DNS records for a domain using NextDNS as the DoH resolver, returning records, TTL, response code, DNSSEC validation status, and resolver latency.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/nextdns?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-22
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-via-nextdns-1d853628
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_popBdpriPF9yV1QeR99qj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-via-nextdns-1d853628
```

Example prompt: Can you look up the TLSA records for mail.example.com using NextDNS as the resolver and tell me the records, TTL, response code, whether DNSSEC was validated, and how fast NextDNS answered?

## When to prefer this

Use this endpoint when you specifically want to observe how NextDNS resolves TLSA records for a domain — particularly for DANE validation workflows, resolver comparison studies, or detecting whether NextDNS is applying filtering or returning split-horizon answers. Prefer this over generic DNS tools when you need the resolver-specific metadata (DNSSEC validation status, answer time) from NextDNS specifically.

## Known failure modes

- Domain does not exist: returns NXDOMAIN response code with empty record set
- No TLSA record at queried name: returns NOERROR with empty answer section
- DNSSEC validation failure: may return SERVFAIL with DNSSEC validation flag false
- Resolver timeout or upstream failure: returns SERVFAIL
- Missing or malformed domain input: request may return an error or empty response
- NextDNS upstream unavailable: SERVFAIL propagated to response

## How this service works

TLSA records for a domain as answered by NextDNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA resource records for the queried domain (or an empty set), the TTL of the record set, the DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), a boolean indicating whether NextDNS validated DNSSEC for the response, and the resolver's answer time in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-via-nextdns-1d853628/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)