{"uid":"cap_1YV1aup4ELctvCKwYIK7z","slug":"probekit-dnssec-status-check-aee2206f","name":"ProbeKit DNSSEC Status Check","description":"Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA-1 digests and DS records without a matching key. Use when an agent must tell whether a domain is signed, why it fails on validating resolvers, or whether a key rollover left the chain of trust broken.","url":"https://api.probekit.dev/v1/dns/dnssec?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TL6eDgDzD3GAo5jmTQcq0","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a domain's DNSSEC chain of trust and reports its status (secure, insecure, bogus, or unknown) along with DS/DNSKEY algorithms, deprecated algorithms, and broken key details.","exampleAgentPrompt":"Can you check the DNSSEC status of example.com — I want to know if it's properly signed, whether the chain of trust is intact, and if any deprecated algorithms are being used?","exampleUseCases":[{"title":"Post-rollover chain of trust audit","prompt":"We just did a DNSSEC key rollover on acmecorp.com — can you check if the DS records still match the DNSKEY records and whether the chain of trust is intact or broken?"},{"title":"Diagnosing SERVFAIL on validating resolvers","prompt":"Users are reporting that payments.mybusiness.net returns SERVFAIL on some resolvers. Can you check its DNSSEC status and tell me if it's showing as bogus or if there's an algorithm issue causing the failures?"},{"title":"Pre-launch DNS security compliance check","prompt":"Before we go live with newstartup.io, can you verify its DNSSEC configuration — is it properly signed, are there any deprecated algorithms or SHA-1 digests we need to replace?"}],"resultDescription":"Returns the DNSSEC validation status (secure, insecure, bogus, or unknown) as determined by public validating resolvers, along with DS record details, DNSKEY algorithms in use, flags for deprecated algorithms, SHA-1 digest usage, and any DS records that lack a matching DNSKEY — enabling diagnosis of chain-of-trust failures.","failureModes":["Invalid or malformed domain name returns a 400 error","Domain does not exist (NXDOMAIN) may return unknown status","Timeout from upstream resolvers may result in unknown status","Payment not included or insufficient results in 402 Payment Required","Rate limiting may occur for rapid successive queries"],"whenToPreferThis":"Use this endpoint when you need to specifically validate DNSSEC configuration for a domain — particularly for diagnosing validation failures, auditing key rollovers, checking for deprecated algorithms, or confirming a domain's signing status on validating resolvers. It is more focused than a general DNS resolver endpoint because it interprets the full DNSSEC chain of trust, not just raw record presence.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T19:03:54.950Z","isFirstParty":false,"canonicalSlug":"probekit-dnssec-status-check-aee2206f"}