{"uid":"cap_zAx6DuIjLLSKKuIYl-DZ8","slug":"ddg-dnssec-check-a2d88dd3","name":"DDG DNSSEC Check","description":"DNSSEC status for a domain via DNS-over-HTTPS cross-checked on two public resolvers: AD flag, DS at the parent, DNSKEY presence, and broken-chain detection. Machine-readable status: secure / unsigned / broken_chain_ds_without_dnskey / signed_not_validated_by_resolver.","url":"https://agents.daedalusdevelopmentgroup.com/v1/dnssec-check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input","output"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object"},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":true},"output":{"type":"object","required":["type","example"],"properties":{"type":{"type":"string"},"example":{"ok":true}},"additionalProperties":true}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_K-RGyZD-pYJz5qM_0TdRA","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks DNSSEC status of a domain via DNS-over-HTTPS cross-validated on two public resolvers, returning machine-readable secure/unsigned/broken statuses","exampleAgentPrompt":"Can you check whether example.com has DNSSEC properly configured — I want to know if it's fully validated, unsigned, or has a broken chain?","exampleUseCases":[{"title":"Pre-deployment DNSSEC audit","prompt":"Before we go live, can you verify that our domain mycompany.com has DNSSEC properly set up — specifically whether the DS record at the parent matches the DNSKEY and the resolver marks it as secure?"},{"title":"Diagnosing DNSSEC chain breakage","prompt":"Our users are getting DNS resolution failures for clientportal.acmecorp.net — can you check the DNSSEC chain to see if there's a broken DS-to-DNSKEY link causing the problem?"},{"title":"Bulk security posture check for acquired domains","prompt":"We just acquired newbrand.io — can you run a DNSSEC check on it to find out if it's signed and validated, unsigned, or misconfigured before we migrate traffic?"}],"resultDescription":"Returns a machine-readable DNSSEC status for the queried domain: one of 'secure', 'unsigned', 'broken_chain_ds_without_dnskey', or 'signed_not_validated_by_resolver'. Also indicates presence of the AD (Authenticated Data) flag from the resolver, whether DS records exist at the parent zone, and whether DNSKEY records are present — all cross-checked across two public DNS-over-HTTPS resolvers.","failureModes":["Domain does not exist (NXDOMAIN) — may return error or unsigned status","Network timeout reaching DNS-over-HTTPS resolvers — service error returned","Malformed domain name input — validation error","Resolver disagreement between the two public resolvers — ambiguous result","Transient DNS propagation during zone signing — status may be temporarily inconsistent"],"whenToPreferThis":"Use this endpoint when you need a fast, authoritative, machine-readable DNSSEC validation result cross-checked across two resolvers — not just a single-resolver lookup. Prefer it over raw DNS queries when you need structured status codes (secure/unsigned/broken_chain) rather than raw DNS records, or when building automated security audits that need to distinguish broken chains from unsigned domains. Ideal for agent workflows requiring payment-gated, on-demand DNS security checks without operating your own resolver infrastructure.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T12:40:42.994Z","isFirstParty":false,"canonicalSlug":"ddg-dnssec-check-a2d88dd3"}