# Lookproof CAA Record Lookup

> Lookproof CAA Record Lookup is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-31).

Evaluate a domain's CAA (Certification Authority Authorization) DNS records, climbing to parent domains if needed, to determine which CAs may issue certificates and why certificate requests may be refused.

## Facts

- Endpoint: GET https://api.lookproof.dev/v1/dns/caa?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-caa-record-lookup-38b27264
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KGHCiITqetkH7iSLe4_aY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-caa-record-lookup-38b27264
```

Example prompt: Check which certificate authorities are allowed to issue TLS certificates for stripe.com — including wildcard certs — and flag any invalid or unknown critical CAA tags that could block issuance.

## When to prefer this

Use this endpoint when you specifically need to audit or debug CAA DNS policy for a domain — particularly to determine which CAs are permitted to issue TLS certificates, why a certificate request was rejected, or to verify CAA configuration before initiating a certificate order. Prefer this over general DNS lookup tools when you need RFC 8659-compliant CAA resolution with automatic parent-domain climbing and structured analysis of critical tags and invalid values.

## Known failure modes

- Invalid or malformed domain name returns a validation error
- Domain does not exist (NXDOMAIN) may return empty or error response
- Network timeouts reaching upstream DNS resolvers
- Rate limiting or payment failure (x402) if insufficient USDC balance
- Upstream DNS resolver unavailable causing lookup failure

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

Returns the resolved CAA records for the domain (climbing to parent names if the queried name has none), including: list of allowed issuers for standard certificates (issue), allowed issuers for wildcard certificates (issuewild), iodef incident reporting addresses, any unknown critical tags, and any invalid or malformed CAA values that could interfere with certificate issuance.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-caa-record-lookup-38b27264/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)