# NetIntel DNSSEC Validator

> NetIntel DNSSEC Validator is a paid API for AI agents from netintel.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Validates DNSSEC configuration for a domain, returning a grade, score, chain-of-trust status, and detailed component breakdown

## Facts

- Endpoint: GET https://netintel.dev/dnssec/validate
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-dnssec-validator-8eed8a7e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VCJ8GpF34a3Nv2bTknuEO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-dnssec-validator-8eed8a7e
```

Example prompt: Can you validate the DNSSEC configuration for cloudflare.com and tell me if the chain of trust is complete, what grade it gets, and whether the DS record is present at the TLD?

## When to prefer this

Use this endpoint when you need a comprehensive, scored audit of a domain's DNSSEC posture including chain-of-trust verification, algorithm identification, and a human-readable grade. Prefer this over raw DNS lookup tools when you want structured scoring and component-level detail rather than just raw DNS records.

## Known failure modes

- Domain does not exist — may return error or incomplete data
- Domain has no DNSSEC configured — returns dnssec_enabled:false with low/zero score
- Network timeout reaching authoritative DNS servers
- Invalid domain format — missing required query parameter returns validation error
- Payment failure via x402 — 402 response if USDC payment not provided

## How this service works

Validate a domain's DNSSEC configuration over DNS-over-HTTPS: DS records at the parent zone, DNSKEY records at the domain, RRSIG signatures, NSEC/NSEC3, plus the validating resolver's AD bit — returns a full chain-of-trust assessment and readiness score so agents can verify DNS integrity before trusting resolution results.

## Output

A JSON object containing: a letter grade (e.g. 'A'), a numeric score (0-100), whether DNSSEC is enabled, whether TLD DS record is present, chain-of-trust status ('complete' or otherwise), a findings array with any issues, and a components breakdown covering DS records (count, algorithms), DNSKEY records (count, key types KSK/ZSK), RRSIG signatures, and NSEC/NSEC3 presence.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain name to validate DNSSEC for (e.g. example.com)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "domain": {
       "type": "string"
      },
      "findings": {
       "type": "array"
      },
      "components": {
       "type": "object"
      },
      "chain_of_trust": {
       "type": "string"
      },
      "dnssec_enabled": {
       "type": "boolean"
      },
      "tld_ds_present": {
       "type": "boolean"
      },
      "resolver_validated": {
       "type": "boolean",
       "description": "Validating resolver's AD bit — chain verified upstream"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "grade": "A",
  "score": 100,
  "domain": "example.com",
  "findings": [],
  "components": {
   "ds_record": {
    "count": 1,
    "present": true,
    "algorithms": [
     "ECDSAP256SHA256"
    ]
   },
   "rrsig_record": {
    "present": true,
    "signatures_found": 1
   },
   "dnskey_record": {
    "count": 4,
    "present": true,
    "key_types": [
     "ZSK",
     "KSK",
     "ZSK",
     "ZSK"
    ]
   },
   "nsec_or_nsec3": {
    "type": "NSEC",
    "present": true
   }
  },
  "chain_of_trust": "complete",
  "dnssec_enabled": true,
  "tld_ds_present": true,
  "resolver_validated": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-dnssec-validator-8eed8a7e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)