# dns-tlsa-via-opendns

> dns-tlsa-via-opendns is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-22).

Fetches TLSA DNS records for a domain using OpenDNS as the DNS-over-HTTPS resolver, returning records, TTL, response code, DNSSEC validation status, and answer time.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/tlsa/via/opendns?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-22
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-via-opendns-ffbab1d1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fl0Yf0gEP-ucedufQ_Fr-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-via-opendns-ffbab1d1
```

Example prompt: Can you look up the TLSA records for example.com using OpenDNS as the resolver and tell me the response code, TTL, whether DNSSEC was validated, and how fast the answer came back?

## When to prefer this

Choose this endpoint when you need TLSA record data specifically as seen by OpenDNS, to compare resolver behavior, detect propagation delays, or identify filtering/split-horizon differences versus other resolvers like Cloudflare or DNSPod. Ideal for DANE validation checks and DNSSEC compliance auditing from the OpenDNS perspective.

## Known failure modes

- Domain does not exist — returns NXDOMAIN response code
- No TLSA records configured for the domain — empty records with NOERROR
- OpenDNS resolver is unreachable or times out — returns SERVFAIL
- Invalid domain format — may return an error or SERVFAIL
- DNSSEC validation failure — resolver may return SERVFAIL with AD flag unset

## How this service works

TLSA records for a domain as answered by OpenDNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.

## Output

Returns the TLSA DNS records for the queried domain as resolved by OpenDNS via DoH, including: the record data, TTL, response code (NOERROR, NXDOMAIN, or SERVFAIL), a boolean indicating whether the resolver performed DNSSEC validation, and the resolver's answer latency in milliseconds.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-via-opendns-ffbab1d1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)