{"uid":"cap_k4TpDKw5PiR4MyuuIFTtn","slug":"dnssec-health-check-1212e01b","name":"DNSSEC Health Check","description":"DNSSEC health check: reports whether a domain is DNSSEC-signed (DNSKEY), has a DS record at the parent, and whether the resolver authenticated the answer, with advisory warnings.","url":"https://dns.use.x402atlas.com/dnssec","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","maxLength":253,"minLength":1,"description":"Bare domain to check for DNSSEC signing (not an IP literal, not localhost, not under a reserved suffix like .local/.internal)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["domain","dnssec_enabled","has_ds","authenticated","warnings","queried_at"],"properties":{"domain":{"type":"string","description":"The queried domain"},"has_ds":{"type":"boolean","description":"True when the parent zone publishes a DS record"},"warnings":{"type":"array","items":{"type":"string"},"description":"Advisory posture warnings; never affects the status code"},"queried_at":{"type":"string","format":"date-time","description":"UTC timestamp of the check"},"authenticated":{"type":"boolean","description":"True when the resolver set the DoH AD (Authenticated Data) flag"},"dnssec_enabled":{"type":"boolean","description":"True when a DNSKEY record is present"}}}}}}},"responseSchema":{"type":"json","example":{"domain":"cloudflare.com","has_ds":true,"warnings":[],"queried_at":"2026-06-05T12:00:00Z","authenticated":true,"dnssec_enabled":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_8DWAXdhSU69DB1aoGRR3i","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a domain is DNSSEC-signed (DNSKEY present), has a DS record at the parent zone, and whether the resolver authenticated the answer, returning advisory warnings.","exampleAgentPrompt":"Can you run a DNSSEC health check on cloudflare.com and tell me whether it's properly signed, has a DS record at the parent, and whether the resolver authenticated the answer?","exampleUseCases":null,"resultDescription":"Returns a structured JSON report indicating whether the domain has a DNSKEY record (is DNSSEC-signed), whether a DS record exists at the parent zone, whether the DNS resolver authenticated the response, and any advisory warnings about misconfigurations or incomplete DNSSEC deployment.","failureModes":["Invalid or malformed domain name returns an error","Domain does not exist (NXDOMAIN) may result in empty or error response","Resolver timeout causes delayed or failed response","Network issues between the service and authoritative nameservers may cause incomplete results"],"whenToPreferThis":"Use this endpoint when you need a quick, structured DNSSEC health report for a specific domain — especially when you need to verify the full chain of trust (DNSKEY + DS record + resolver authentication) rather than just a raw DNS record lookup. Prefer this over generic DNS tools when you specifically need DNSSEC validation status with advisory warnings.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T18:41:05.012Z","isFirstParty":false}