{"uid":"cap_R7dZO2s9UxfbQTg_m25Sg","slug":"probekit-caa-dns-lookup-0fa0a9dc","name":"ProbeKit CAA DNS Lookup","description":"Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcard certificates, iodef, unknown critical tags and invalid values. Use when an agent must tell which certificate authorities may issue for a domain, or why a certificate request is refused because of CAA.","url":"https://api.probekit.dev/v1/dns/caa?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pIl435-aQicbhcsB3OQAU","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Evaluates a domain's CAA records (including parent-name climbing) to determine which CAs are authorized to issue certificates, detect iodef reporting addresses, unknown critical tags, and invalid values.","exampleAgentPrompt":"Can you check the CAA records for stripe.com and tell me which certificate authorities are allowed to issue certificates for it, including for wildcards, and flag any invalid values or unknown critical tags?","exampleUseCases":[{"title":"Debug certificate issuance failure","prompt":"Our Let's Encrypt certificate renewal for api.example.com keeps failing — can you check its CAA records and tell me if Let's Encrypt is actually authorized to issue there, and whether any parent domain records are overriding it?"},{"title":"Pre-issuance CA authorization check","prompt":"Before we request a wildcard TLS cert from DigiCert for *.shop.mybrand.com, can you check the CAA records to confirm DigiCert is listed as an allowed wildcard issuer?"},{"title":"Domain security audit for CAA policy","prompt":"I'm auditing the DNS security posture for contoso.com — can you pull its CAA records and tell me which CAs are authorized, whether there's an iodef reporting address configured, and if there are any unknown critical tags or malformed entries?"}],"resultDescription":"Returns the CAA records found for the domain (or the closest parent up to the registrable domain if none exist at the queried name), listing: allowed issuers for normal DV/OV/EV certificates, allowed issuers for wildcard certificates, iodef incident reporting addresses, any unknown critical tags that would block issuance, and any invalid or malformed CAA values.","failureModes":["Domain not found or does not exist in DNS — returns empty or NXDOMAIN result","Malformed domain input (too long, invalid characters) — returns validation error","No CAA records found anywhere in the hierarchy up to the registrable domain — returns empty allowed issuers (meaning any CA may issue)","Network or resolver timeout reaching authoritative DNS — returns error response","Missing required 'domain' query parameter — returns 400-level error"],"whenToPreferThis":"Use this endpoint when you need to specifically interpret CAA policy for certificate issuance decisions — it goes beyond raw DNS resolution by climbing the parent-name hierarchy per RFC 8659, categorizing record tags (issue, issuewild, iodef), and flagging invalid values and unknown critical tags. Prefer it over a generic DNS resolver when the goal is to answer 'can CA X issue for domain Y' or to debug why a certificate request was refused.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T19:05:45.743Z","isFirstParty":false,"canonicalSlug":"probekit-caa-dns-lookup-0fa0a9dc"}