{"uid":"cap_GkWZWxmM218Na6CQEXF4-","slug":"dnssec-trust-chain-validator-a2ff91fa","name":"DNSSEC Trust Chain Validator","description":"DNSSEC status for a domain using Cloudflare's public resolver (1.1.1.1 DNS-over-HTTPS): whether the resolver validated the answer (AD flag), the DS records in the parent zone, and the DNSKEY records with key-signing keys. The validation is done by Cloudflare's resolver, not by this tool walking the chain to the root.","url":"https://api.fadeandco.workers.dev/api/agent-intel/dnssec-trust-chain-validator?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain such as ietf.org (a URL is reduced to its host)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"note":"Validation is by the Cloudflare resolver's AD flag, not an independent chain walk from the root. An UNSIGNED result means no DS record exists in the parent zone.","domain":"ietf.org","rcodeA":0,"source":"https://1.1.1.1/dns-query","verdict":"VALIDATED_BY_RESOLVER","checkedAt":"2026-10-23T09:35:21.650Z","dsRecords":[{"keyTag":2371,"algorithm":13,"digestType":2}],"dnskeyCount":2,"keySigningKeys":1,"resolverValidated":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_dvodtvE8vxb46XhFWXtbd","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks DNSSEC validation status for a domain using Cloudflare's 1.1.1.1 DNS-over-HTTPS resolver, returning the AD flag, DS records, and DNSKEY/KSK records.","exampleAgentPrompt":"Can you check whether ietf.org has DNSSEC properly validated — I want to know if Cloudflare's resolver sets the AD flag, and whether there are DS records and key-signing keys in place?","exampleUseCases":[{"title":"Pre-deployment DNSSEC audit","prompt":"Before we go live, can you check if example.com has DNSSEC properly set up — does it have DS records in the parent zone and does Cloudflare's resolver validate it with the AD flag?"},{"title":"Security compliance domain check","prompt":"I need to verify that cloudflare.com passes DNSSEC validation — can you tell me if the resolver marks it as validated, how many DNSKEY records it has, and whether there are key-signing keys?"},{"title":"Investigating DNS trust issues","prompt":"We're seeing DNS trust warnings for paypal.com — can you check its DNSSEC status, whether Cloudflare's resolver validates it, and if DS records exist in the parent zone?"}],"resultDescription":"Returns a JSON object with: the domain checked, a verdict string (e.g. VALIDATED_BY_RESOLVER, UNSIGNED), whether the resolver set the AD flag (resolverValidated boolean), the RCODE for the A record query, an array of DS records (keyTag, algorithm, digestType), the count of DNSKEY records, the number of key-signing keys, the source resolver URL, and a timestamp. Also includes a note clarifying that validation relies on Cloudflare's resolver AD flag rather than an independent chain walk.","failureModes":["Domain does not exist (NXDOMAIN) — may return RCODE 3 with no DS/DNSKEY data","Domain has no DS record in parent zone — verdict is UNSIGNED","Resolver unreachable — timeout or upstream error from Cloudflare 1.1.1.1","Invalid or malformed domain input — may return an error or unexpected result","Domain exists but DNSSEC is misconfigured — resolver may return SERVFAIL (RCODE 2)"],"whenToPreferThis":"Choose this endpoint when you need a quick, resolver-perspective DNSSEC status check using Cloudflare's 1.1.1.1 infrastructure. It's ideal for automated compliance checks, pre-deployment audits, or security monitoring where you want to know if a domain is DNSSEC-signed and resolver-validated without running your own full chain validation. Not suitable if you need an independent cryptographic chain-walk from the root, or if you need to validate DNSSEC signatures yourself rather than relying on a trusted resolver's AD flag.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T12:42:52.753Z","isFirstParty":false,"canonicalSlug":"dnssec-trust-chain-validator-a2ff91fa"}