# ProbeKit DNSSEC Status Check

> ProbeKit DNSSEC Status Check is a paid API for AI agents from api.probekit.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Validates a domain's DNSSEC chain of trust and reports its status (secure, insecure, bogus, or unknown) along with DS/DNSKEY algorithms, deprecated algorithms, and broken key details.

## Facts

- Endpoint: GET https://api.probekit.dev/v1/dns/dnssec?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/probekit-dnssec-status-check-aee2206f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1YV1aup4ELctvCKwYIK7z

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability probekit-dnssec-status-check-aee2206f
```

Example prompt: Can you check the DNSSEC status of example.com — I want to know if it's properly signed, whether the chain of trust is intact, and if any deprecated algorithms are being used?

## When to prefer this

Use this endpoint when you need to specifically validate DNSSEC configuration for a domain — particularly for diagnosing validation failures, auditing key rollovers, checking for deprecated algorithms, or confirming a domain's signing status on validating resolvers. It is more focused than a general DNS resolver endpoint because it interprets the full DNSSEC chain of trust, not just raw record presence.

## Known failure modes

- Invalid or malformed domain name returns a 400 error
- Domain does not exist (NXDOMAIN) may return unknown status
- Timeout from upstream resolvers may result in unknown status
- Payment not included or insufficient results in 402 Payment Required
- Rate limiting may occur for rapid successive queries

## How this service works

Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA-1 digests and DS records without a matching key. Use when an agent must tell whether a domain is signed, why it fails on validating resolvers, or whether a key rollover left the chain of trust broken.

## Output

Returns the DNSSEC validation status (secure, insecure, bogus, or unknown) as determined by public validating resolvers, along with DS record details, DNSKEY algorithms in use, flags for deprecated algorithms, SHA-1 digest usage, and any DS records that lack a matching DNSKEY — enabling diagnosis of chain-of-trust failures.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/probekit-dnssec-status-check-aee2206f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.probekit.dev](https://www.zero.xyz/host/api.probekit.dev/llms.txt)