# ProbeKit CAA DNS Lookup

> ProbeKit CAA DNS Lookup is a paid API for AI agents from api.probekit.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Evaluates a domain's CAA records (including parent-name climbing) to determine which CAs are authorized to issue certificates, detect iodef reporting addresses, unknown critical tags, and invalid values.

## Facts

- Endpoint: GET https://api.probekit.dev/v1/dns/caa?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/probekit-caa-dns-lookup-0fa0a9dc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_R7dZO2s9UxfbQTg_m25Sg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability probekit-caa-dns-lookup-0fa0a9dc
```

Example prompt: Can you check the CAA records for stripe.com and tell me which certificate authorities are allowed to issue certificates for it, including for wildcards, and flag any invalid values or unknown critical tags?

## When to prefer this

Use this endpoint when you need to specifically interpret CAA policy for certificate issuance decisions — it goes beyond raw DNS resolution by climbing the parent-name hierarchy per RFC 8659, categorizing record tags (issue, issuewild, iodef), and flagging invalid values and unknown critical tags. Prefer it over a generic DNS resolver when the goal is to answer 'can CA X issue for domain Y' or to debug why a certificate request was refused.

## Known failure modes

- Domain not found or does not exist in DNS — returns empty or NXDOMAIN result
- Malformed domain input (too long, invalid characters) — returns validation error
- No CAA records found anywhere in the hierarchy up to the registrable domain — returns empty allowed issuers (meaning any CA may issue)
- Network or resolver timeout reaching authoritative DNS — returns error response
- Missing required 'domain' query parameter — returns 400-level error

## How this service works

Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcard certificates, iodef, unknown critical tags and invalid values. Use when an agent must tell which certificate authorities may issue for a domain, or why a certificate request is refused because of CAA.

## Output

Returns the CAA records found for the domain (or the closest parent up to the registrable domain if none exist at the queried name), listing: allowed issuers for normal DV/OV/EV certificates, allowed issuers for wildcard certificates, iodef incident reporting addresses, any unknown critical tags that would block issuance, and any invalid or malformed CAA values.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/probekit-caa-dns-lookup-0fa0a9dc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.probekit.dev](https://www.zero.xyz/host/api.probekit.dev/llms.txt)