# DNSSEC Check

> DNSSEC Check is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Checks a domain's DNSSEC status including DS and DNSKEY record presence, resolver validation (AD flag), and signing algorithms used.

## Facts

- Endpoint: GET https://intel.rallylive.ca/dns/dnssec
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dnssec-check-51449c73
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_EydbxZXclq6JemJlVRc-O

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dnssec-check-51449c73
```

Example prompt: Can you check whether example.com has DNSSEC properly set up — I want to know if the DS and DNSKEY records are present, whether the resolver is validating the chain, and what signing algorithms are being used?

## When to prefer this

Choose this endpoint when you need a focused, fast DNSSEC-specific security check for a single domain — covering DS records, DNSKEY records, resolver AD flag validation, and signing algorithms — rather than a broad DNS or domain intelligence report. Ideal for security audits, compliance checks, pre-acquisition due diligence, or post-migration validation where DNSSEC chain integrity is the primary concern.

## Known failure modes

- Domain does not exist or is unreachable — returns no records found
- Domain has no DNSSEC records (unsigned zone) — returns absent DS/DNSKEY status
- Resolver cannot validate chain (broken DNSSEC) — AD flag returns false with error details
- Invalid or malformed domain name input — returns validation error
- Network timeout reaching authoritative nameservers — returns timeout error

## How this service works

DNSSEC check for a domain: whether DS and DNSKEY records exist, whether the resolver validates the chain (AD flag), signing algorithms used. Security posture and DNS hygiene audits. $0.01 per check.

## Output

Returns whether DS and DNSKEY records exist for the domain, whether the resolver validates the DNSSEC chain (indicated by the AD flag), the signing algorithms in use, and an overall assessment of the domain's DNSSEC security posture.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dnssec-check-51449c73/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)