{"uid":"cap_x4uzRgr1vnQPGoJLbcDFh","slug":"lookproof-dns-wildcard-detector-e3c0e356","name":"Lookproof DNS Wildcard Detector","description":"Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.","url":"https://api.lookproof.dev/v1/dns/wildcard?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_I_oYbZsUPachkK_Itepzy","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a DNS zone has a wildcard record (RFC 4592) by querying A, AAAA, TXT, and MX types for a random uncached subdomain, with a warning if wildcard MX accepts mail for invented subdomains.","exampleAgentPrompt":"Can you check if example.com has a DNS wildcard — specifically whether any random subdomain resolves due to a wildcard A, AAAA, TXT, or MX record, and warn me if there's a wildcard MX that would accept mail for made-up subdomains?","exampleUseCases":[{"title":"Subdomain existence verification before action","prompt":"Before I add a new subdomain for our app deployment, can you check if api.acmecorp.com would actually be a real DNS entry or just match a wildcard in the acmecorp.com zone?"},{"title":"Wildcard MX security audit","prompt":"I need to know if mailsecure.io has a wildcard MX record — I'm worried it might accept email for any invented subdomain, which would be a security risk."},{"title":"DNS recon for bug bounty scoping","prompt":"Can you check whether targetsite.com uses DNS wildcards? I want to know if subdomains I'm finding during recon actually exist or are just wildcard matches."}],"resultDescription":"Returns whether the DNS zone has wildcard records for A, AAAA, TXT, and MX record types, determined by querying a random uncached subdomain through public resolvers. Includes a specific warning if a wildcard MX record is detected, meaning the domain would accept mail for any invented subdomain.","failureModes":["Invalid or malformed domain name returns a 4xx error","Domain does not exist in DNS (NXDOMAIN) may return an indeterminate or error result","Public resolver timeouts may cause lookup failures","Very long domain names exceeding 1024 characters are rejected","Domains with aggressive rate limiting on public resolvers may produce incomplete results"],"whenToPreferThis":"Choose this endpoint when you need to definitively determine whether a subdomain truly exists in DNS or is simply matched by a zone-wide wildcard record. It is especially useful for security audits, subdomain enumeration validation, and email infrastructure checks. Prefer it over a plain DNS resolver when wildcard-awareness is required — a standard resolve would return results for invented subdomains without flagging that a wildcard is responsible.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:34:20.772Z","isFirstParty":false,"canonicalSlug":"lookproof-dns-wildcard-detector-e3c0e356"}