# Lookproof DNSSEC Validator

> Lookproof DNSSEC Validator is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-31).

Reports the DNSSEC validation status of a domain (secure, insecure, bogus, or unknown) including DS/DNSKEY algorithms, deprecated algorithms, SHA-1 digests, and broken chain-of-trust detection.

## Facts

- Endpoint: GET https://api.lookproof.dev/v1/dns/dnssec?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-dnssec-validator-7e33d495
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ogu2s31CwLgtgobuwpxxl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-dnssec-validator-7e33d495
```

Example prompt: Can you check the DNSSEC status of cloudflare.com — is it properly signed, and are there any broken chain-of-trust issues or deprecated algorithms I should know about?

## When to prefer this

Use this endpoint when you specifically need DNSSEC validation state and chain-of-trust diagnostics — not just raw DNS record lookups. It is the right choice over generic DNS resolvers when you need to know whether a domain's DNSSEC is signed and valid from a validating resolver's perspective, whether a key rollover broke the chain, whether deprecated algorithms are in use, or whether DS and DNSKEY records are consistent. Prefer sibling endpoints for raw DNS record resolution or TLS certificate checks.

## Known failure modes

- Domain does not exist or cannot be resolved — returns unknown status or error
- Timeout from public resolvers when checking validation status
- Malformed domain input (too long, invalid characters) — rejected by input validation
- Domain has no DS records at parent zone — reported as insecure rather than bogus
- Network-level issues reaching upstream resolvers — may return incomplete data

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

Returns the DNSSEC validation status (secure, insecure, bogus, or unknown) as seen by public validating resolvers, along with the DS and DNSKEY algorithm identifiers, any deprecated algorithm warnings, SHA-1 digest flags, and details on DS records that lack a matching DNSKEY — enabling diagnosis of why DNSSEC validation passes or fails.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-dnssec-validator-7e33d495/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)