{"uid":"cap_x6bmiRQ27375lE8U559ep","slug":"netintel-production-440c-up-railway-app-1d711e05","name":"DNSSEC Validation & Chain-of-Trust Checker","description":"Validate a domain's DNSSEC configuration by checking for DS records at the parent zone, DNSKEY records at the domain, RRSIG signatures, and NSEC/NSEC3 records — returns a full chain-of-trust assessment and readiness score so agents can verify DNS integrity before trusting resolution results.","url":"https://netintel-production-440c.up.railway.app/dnssec/validate?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain name to validate DNSSEC for (e.g. example.com)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"grade":{"type":"string"},"score":{"type":"number"},"domain":{"type":"string"},"findings":{"type":"array"},"components":{"type":"object"},"chain_of_trust":{"type":"string"},"dnssec_enabled":{"type":"boolean"},"tld_ds_present":{"type":"boolean"},"resolver_validated":{"type":"boolean","description":"Validating resolver's AD bit — chain verified upstream"}}}}}}},"responseSchema":{"type":"json","example":{"grade":"A","score":100,"domain":"example.com","findings":[],"components":{"ds_record":{"count":1,"present":true,"algorithms":["ECDSAP256SHA256"]},"rrsig_record":{"present":true,"signatures_found":1},"dnskey_record":{"count":4,"present":true,"key_types":["ZSK","KSK","ZSK","ZSK"]},"nsec_or_nsec3":{"type":"NSEC","present":true}},"chain_of_trust":"complete","dnssec_enabled":true,"tld_ds_present":true,"resolver_validated":true}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"domain":"example.com"}}},"response":{"grade":"F","score":25,"domain":"example.com","findings":[{"rule":"no_dnssec","detail":"No DNSKEY and no RRSIG — DNSSEC not configured","deduction":-60},{"rule":"nsec_missing","detail":"Neither NSEC nor NSEC3 present","deduction":-10},{"rule":"tld_ds_missing","detail":"TLD DS record not found — weakens root trust anchor","deduction":-5}],"components":{"ds_record":{"count":0,"present":false},"rrsig_record":{"present":false,"signatures_found":0},"dnskey_record":{"count":0,"present":false},"nsec_or_nsec3":{"type":null,"present":false}},"chain_of_trust":"none","dnssec_enabled":false,"tld_ds_present":false}},"exampleRequest":{"domain":"example.com"},"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_LkAiKjwY1MiELGi-aL7b7","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a domain's DNSSEC configuration by checking DS records, DNSKEY records, RRSIG signatures, and NSEC/NSEC3 records, returning a full chain-of-trust assessment and readiness score.","exampleAgentPrompt":"Can you validate the DNSSEC configuration for cloudflare.com and tell me whether the chain of trust is intact, whether DS records are present at the parent zone, and what readiness score it gets?","exampleUseCases":null,"resultDescription":"Returns a structured assessment including: whether DNSSEC is enabled, whether TLD DS records are present, individual component checks (DS, DNSKEY, RRSIG, NSEC/NSEC3), a chain-of-trust summary string, a numeric readiness score, a letter grade, and an array of specific findings or issues detected.","failureModes":["Invalid or non-existent domain returns error or empty findings","Domain has no DNSSEC configured — returns dnssec_enabled: false with low score","Network timeout reaching DNS resolvers — may return partial results","Malformed domain input returns validation error","TLD does not support DNSSEC — DS record check may be inconclusive"],"whenToPreferThis":"Use this endpoint when you need to verify a domain's DNSSEC integrity before trusting its DNS resolution results, when auditing DNS security posture, when troubleshooting DNSSEC misconfiguration, or when you need a graded chain-of-trust assessment rather than just a raw DNS lookup. Prefer this over a generic DNS lookup endpoint when the goal is specifically cryptographic DNS validation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:30:43.087Z","isFirstParty":false,"canonicalSlug":"netintel-production-440c-up-railway-app-1d711e05"}