{"uid":"cap_ogu2s31CwLgtgobuwpxxl","slug":"lookproof-dnssec-validator-7e33d495","name":"Lookproof DNSSEC Validator","description":"Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.","url":"https://api.lookproof.dev/v1/dns/dnssec?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_uNLEOQ7swZhm9z2freqPQ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Reports the DNSSEC validation status of a domain (secure, insecure, bogus, or unknown) including DS/DNSKEY algorithms, deprecated algorithms, SHA-1 digests, and broken chain-of-trust detection.","exampleAgentPrompt":"Can you check the DNSSEC status of cloudflare.com — is it properly signed, and are there any broken chain-of-trust issues or deprecated algorithms I should know about?","exampleUseCases":[{"title":"Key rollover chain-of-trust check","prompt":"We just rolled our DNSSEC keys for mybusiness.net — can you verify the chain of trust is still intact and DS records match the new DNSKEY?"},{"title":"DNSSEC compliance audit","prompt":"I need to audit whether example.org is properly DNSSEC-signed and not using any deprecated algorithms or SHA-1 digests before we go live."},{"title":"Diagnosing bogus DNSSEC status","prompt":"Our domain payments.io is being flagged as bogus by validating resolvers — can you check what's wrong with our DNSSEC setup?"}],"resultDescription":"Returns the DNSSEC validation status (secure, insecure, bogus, or unknown) as seen by public validating resolvers, along with the DS and DNSKEY algorithm identifiers, any deprecated algorithm warnings, SHA-1 digest flags, and details on DS records that lack a matching DNSKEY — enabling diagnosis of why DNSSEC validation passes or fails.","failureModes":["Domain does not exist or cannot be resolved — returns unknown status or error","Timeout from public resolvers when checking validation status","Malformed domain input (too long, invalid characters) — rejected by input validation","Domain has no DS records at parent zone — reported as insecure rather than bogus","Network-level issues reaching upstream resolvers — may return incomplete data"],"whenToPreferThis":"Use this endpoint when you specifically need DNSSEC validation state and chain-of-trust diagnostics — not just raw DNS record lookups. It is the right choice over generic DNS resolvers when you need to know whether a domain's DNSSEC is signed and valid from a validating resolver's perspective, whether a key rollover broke the chain, whether deprecated algorithms are in use, or whether DS and DNSKEY records are consistent. Prefer sibling endpoints for raw DNS record resolution or TLS certificate checks.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:45.975Z","isFirstParty":false,"canonicalSlug":"lookproof-dnssec-validator-7e33d495"}