# DNSSEC Validation & Chain-of-Trust Checker

> DNSSEC Validation & Chain-of-Trust Checker is a paid API for AI agents from netintel-production-440c.up.railway.app, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-12).

Validates a domain's DNSSEC configuration by checking DS records, DNSKEY records, RRSIG signatures, and NSEC/NSEC3 records, returning a full chain-of-trust assessment and readiness score.

## Facts

- Endpoint: GET https://netintel-production-440c.up.railway.app/dnssec/validate?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-production-440c-up-railway-app-1d711e05
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_x6bmiRQ27375lE8U559ep

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-production-440c-up-railway-app-1d711e05
```

Example prompt: Can you validate the DNSSEC configuration for cloudflare.com and tell me whether the chain of trust is intact, whether DS records are present at the parent zone, and what readiness score it gets?

## When to prefer this

Use this endpoint when you need to verify a domain's DNSSEC integrity before trusting its DNS resolution results, when auditing DNS security posture, when troubleshooting DNSSEC misconfiguration, or when you need a graded chain-of-trust assessment rather than just a raw DNS lookup. Prefer this over a generic DNS lookup endpoint when the goal is specifically cryptographic DNS validation.

## Known failure modes

- Invalid or non-existent domain returns error or empty findings
- Domain has no DNSSEC configured — returns dnssec_enabled: false with low score
- Network timeout reaching DNS resolvers — may return partial results
- Malformed domain input returns validation error
- TLD does not support DNSSEC — DS record check may be inconclusive

## How this service works

Validate a domain's DNSSEC configuration by checking for DS records at the parent zone, DNSKEY records at the domain, RRSIG signatures, and NSEC/NSEC3 records — returns a full chain-of-trust assessment and readiness score so agents can verify DNS integrity before trusting resolution results.

## Output

Returns a structured assessment including: whether DNSSEC is enabled, whether TLD DS records are present, individual component checks (DS, DNSKEY, RRSIG, NSEC/NSEC3), a chain-of-trust summary string, a numeric readiness score, a letter grade, and an array of specific findings or issues detected.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "domain": "example.com"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain name to validate DNSSEC for (e.g. example.com)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "domain": {
       "type": "string"
      },
      "findings": {
       "type": "array"
      },
      "components": {
       "type": "object"
      },
      "chain_of_trust": {
       "type": "string"
      },
      "dnssec_enabled": {
       "type": "boolean"
      },
      "tld_ds_present": {
       "type": "boolean"
      },
      "resolver_validated": {
       "type": "boolean",
       "description": "Validating resolver's AD bit — chain verified upstream"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "grade": "A",
  "score": 100,
  "domain": "example.com",
  "findings": [],
  "components": {
   "ds_record": {
    "count": 1,
    "present": true,
    "algorithms": [
     "ECDSAP256SHA256"
    ]
   },
   "rrsig_record": {
    "present": true,
    "signatures_found": 1
   },
   "dnskey_record": {
    "count": 4,
    "present": true,
    "key_types": [
     "ZSK",
     "KSK",
     "ZSK",
     "ZSK"
    ]
   },
   "nsec_or_nsec3": {
    "type": "NSEC",
    "present": true
   }
  },
  "chain_of_trust": "complete",
  "dnssec_enabled": true,
  "tld_ds_present": true,
  "resolver_validated": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-production-440c-up-railway-app-1d711e05/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel-production-440c.up.railway.app](https://www.zero.xyz/host/netintel-production-440c.up.railway.app/llms.txt)