# SiteCheck Web Intel DNSSEC Validator

> SiteCheck Web Intel DNSSEC Validator is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks whether a domain has a DS record at its parent zone and whether two public resolvers (AdGuard DNS, NextDNS) return its A record with the DNSSEC authenticated (AD) flag set.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/dnssec-validator?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-dnssec-validator-1c893351
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_FbeBv81gxjC8cPPAUakfG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-dnssec-validator-1c893351
```

Example prompt: Can you check whether cloudflare.com has DNSSEC set up — specifically whether it has a DS record at the parent zone and whether AdGuard DNS and NextDNS both return its address with the authenticated flag?

## When to prefer this

Choose this endpoint when you need a quick, multi-resolver cross-check of a domain's DNSSEC status without deploying your own resolver infrastructure. It is ideal for automated security audits, vendor checks, or incident triage where you want to know both whether the domain is signed (DS record at parent) and whether real-world validating resolvers are honoring that signature (AD flag). It does not replace full DNSSEC chain validation tools but is fast and requires no API keys.

## Known failure modes

- Invalid or malformed domain name returns an error
- Domain does not exist (NXDOMAIN) may result in no DS record found and no AD flag
- Resolver outages at AdGuard DNS or NextDNS could cause partial or failed results
- Domains with misconfigured DNSSEC may show DS record present but AD flag absent
- Network timeouts from the worker to upstream resolvers may cause failures

## How this service works

DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. It reads the resolvers' verdict; it does not validate the signature chain itself.

## Output

Returns whether a DS record exists at the parent zone for the queried domain (indicating the domain is DNSSEC-signed), plus the verdict from two public validating resolvers (AdGuard DNS and NextDNS) on whether they return the A record answer with the AD (authenticated data) flag set. Does not perform full chain-of-trust validation itself.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain name such as example.com (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-dnssec-validator-1c893351/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)