{"uid":"cap_FbeBv81gxjC8cPPAUakfG","slug":"sitecheck-web-intel-dnssec-validator-1c893351","name":"SiteCheck Web Intel DNSSEC Validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. It reads the resolvers' verdict; it does not validate the signature chain itself.","url":"https://api.webintel-api.workers.dev/api/security/dnssec-validator?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain name such as example.com (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Cit9kT0k_UdUgpM29DOZ_","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a domain has a DS record at its parent zone and whether two public resolvers (AdGuard DNS, NextDNS) return its A record with the DNSSEC authenticated (AD) flag set.","exampleAgentPrompt":"Can you check whether cloudflare.com has DNSSEC set up — specifically whether it has a DS record at the parent zone and whether AdGuard DNS and NextDNS both return its address with the authenticated flag?","exampleUseCases":[{"title":"Pre-deployment DNSSEC audit","prompt":"Before we go live with our new domain mybrand.io, can you verify it has a DS record at the parent zone and that both AdGuard DNS and NextDNS are confirming authenticated responses for it?"},{"title":"Vendor security due diligence","prompt":"I'm vetting a new payment processor — can you check whether their domain stripe.com has DNSSEC properly signed and that public resolvers are returning its A record with the AD flag?"},{"title":"Incident investigation for DNS spoofing","prompt":"We had a suspicious DNS event involving paypal.com — can you quickly check if its DNSSEC is intact, whether there's a DS record at the parent zone, and what AdGuard and NextDNS say about its authenticated flag?"}],"resultDescription":"Returns whether a DS record exists at the parent zone for the queried domain (indicating the domain is DNSSEC-signed), plus the verdict from two public validating resolvers (AdGuard DNS and NextDNS) on whether they return the A record answer with the AD (authenticated data) flag set. Does not perform full chain-of-trust validation itself.","failureModes":["Invalid or malformed domain name returns an error","Domain does not exist (NXDOMAIN) may result in no DS record found and no AD flag","Resolver outages at AdGuard DNS or NextDNS could cause partial or failed results","Domains with misconfigured DNSSEC may show DS record present but AD flag absent","Network timeouts from the worker to upstream resolvers may cause failures"],"whenToPreferThis":"Choose this endpoint when you need a quick, multi-resolver cross-check of a domain's DNSSEC status without deploying your own resolver infrastructure. It is ideal for automated security audits, vendor checks, or incident triage where you want to know both whether the domain is signed (DS record at parent) and whether real-world validating resolvers are honoring that signature (AD flag). It does not replace full DNSSEC chain validation tools but is fast and requires no API keys.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:42:33.193Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-dnssec-validator-1c893351"}