{"uid":"cap_popBdpriPF9yV1QeR99qj","slug":"dns-tlsa-via-nextdns-1d853628","name":"dns-tlsa-via-nextdns","description":"TLSA records for a domain as answered by NextDNS (DNS over HTTPS): the records, TTL, response code (NOERROR/NXDOMAIN/SERVFAIL), whether the resolver validated DNSSEC, and the resolver's answer time. Compare resolvers to spot propagation lag, filtering or split-horizon answers. $0.01 per lookup.","url":"https://dns.intel.rallylive.ca/dns/tlsa/via/nextdns?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_JTXirENx5olayWnzo5g_i","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches TLSA DNS records for a domain using NextDNS as the DoH resolver, returning records, TTL, response code, DNSSEC validation status, and resolver latency.","exampleAgentPrompt":"Can you look up the TLSA records for mail.example.com using NextDNS as the resolver and tell me the records, TTL, response code, whether DNSSEC was validated, and how fast NextDNS answered?","exampleUseCases":[{"title":"DANE certificate pinning verification","prompt":"Check the TLSA records for _25._tcp.mail.protonmail.com via NextDNS — I need to know what records are returned, whether DNSSEC was validated, and what the TTL is so I can verify DANE is set up correctly."},{"title":"Resolver propagation lag detection","prompt":"I just published new TLSA records for _443._tcp.secure.mysite.io and I want to see if NextDNS has picked them up yet — can you do a TLSA lookup via NextDNS and tell me the records, TTL, response code, and answer time?"},{"title":"Split-horizon or filtering audit","prompt":"Look up TLSA records for _25._tcp.mail.mydomain.com through NextDNS and tell me the full response including DNSSEC status and response code — I'm trying to figure out if NextDNS is filtering or returning a different answer than my authoritative nameserver."}],"resultDescription":"Returns the TLSA resource records for the queried domain (or an empty set), the TTL of the record set, the DNS response code (NOERROR, NXDOMAIN, or SERVFAIL), a boolean indicating whether NextDNS validated DNSSEC for the response, and the resolver's answer time in milliseconds.","failureModes":["Domain does not exist: returns NXDOMAIN response code with empty record set","No TLSA record at queried name: returns NOERROR with empty answer section","DNSSEC validation failure: may return SERVFAIL with DNSSEC validation flag false","Resolver timeout or upstream failure: returns SERVFAIL","Missing or malformed domain input: request may return an error or empty response","NextDNS upstream unavailable: SERVFAIL propagated to response"],"whenToPreferThis":"Use this endpoint when you specifically want to observe how NextDNS resolves TLSA records for a domain — particularly for DANE validation workflows, resolver comparison studies, or detecting whether NextDNS is applying filtering or returning split-horizon answers. Prefer this over generic DNS tools when you need the resolver-specific metadata (DNSSEC validation status, answer time) from NextDNS specifically.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T18:57:33.038Z","isFirstParty":false,"canonicalSlug":"dns-tlsa-via-nextdns-1d853628"}