---
name: dns.use.x402atlas.com
description: dns.use.x402atlas.com provides two DNS-focused lookup skills: one retrieves structured RDAP domain registration metadata (registrar, dates, status, nameservers, age), and the other checks a domain's DNSSEC posture via DNS-over-HTTPS. Both skills accept a bare domain name and return structured, machine-readable output.
host: dns.use.x402atlas.com
---

# dns.use.x402atlas.com

This host serves agents that need to inspect the registration and security configuration of a domain. It covers two distinct but complementary angles: who registered a domain and when (via RDAP), and whether the domain's DNS responses are cryptographically authenticated (via DNSSEC). It is not a general DNS resolver, does not return raw WHOIS text, and does not support IP lookups or reserved/internal suffixes.

## When to use this host

Use this host when an agent needs structured domain registration data (registrar, dates, status, nameservers) or needs to verify DNSSEC configuration for a public domain. It is well-suited for fraud detection pipelines, trust scoring, pre-deployment DNS validation, and domain research workflows. Do not use it for IP address lookups, localhost, or reserved suffixes (.local, .internal) — those inputs return errors. Do not use it as a substitute for raw WHOIS text output; seek a dedicated /whois endpoint for unstructured text. It is also not suitable for real-time or streaming DNS monitoring — each skill is a single-shot call per domain.

## Capabilities

### Domain Registration Metadata

Retrieves structured RDAP data for a domain, including registrar identity, creation, update, and expiration dates, EPP status codes, nameservers, and computed domain age in days.

- **`fetch-domain-rdap`** — Fetches normalized RDAP domain registration data for a bare domain, returning registrar, creation/expiration/updated dates, EPP status codes, nameservers, and domain age in days.

### DNSSEC Security Posture

Checks whether a domain has DNSSEC enabled, whether the parent zone publishes a DS record, and whether the resolver authenticated the response, returning advisory warnings where applicable.

- **`check-dnssec-posture`** — Checks a domain's DNSSEC posture via DNS-over-HTTPS and returns whether DNSKEY, DS record, and resolver authentication (AD flag) are present, plus advisory warnings.

## Workflows

### Domain Trust and Security Audit

*Use when an agent needs to assess the overall trustworthiness and security configuration of a domain, combining registration age and status with DNSSEC validation posture.*

1. **`fetch-domain-rdap`** — Retrieve registration metadata to establish domain age, registrar, EPP status, and expiration — foundational signals for trust scoring or fraud detection.
2. **`check-dnssec-posture`** — Check whether the domain's DNS is cryptographically secured, surfacing missing DS records or unauthenticated responses as additional risk signals.

## Skill reference

### `fetch-domain-rdap`

**DNS RDAP Lookup** — Fetches normalized RDAP domain registration data for a bare domain, returning registrar, creation/expiration/updated dates, EPP status codes, nameservers, and domain age in days.

*Use when:* Use when an agent needs structured domain registration metadata (registrar, dates, status, nameservers, domain age) for a given domain name, such as for fraud detection, trust scoring, or domain research workflows.

*Not for:* Do not use for IP address lookups, localhost, or reserved suffixes like .local/.internal — those return 400. Not a substitute for raw WHOIS text; use a /whois endpoint if unstructured text output is required.

**Inputs:**

- `domain` (string, required) — Bare domain to look up via RDAP. Must not be an IP literal, localhost, or a reserved suffix (e.g. .local/.internal). Max 253 characters.

**Returns:** Returns a normalized domain record with registrar, created/updated/expiration dates, EPP status array, nameservers array, domain_age_days integer, and queried_at timestamp; example.com shows 11298 days old with Cloudflare nameservers.

**Example:** `GET https://dns.use.x402atlas.com/rdap?domain=example.com`

---

### `check-dnssec-posture`

**DNSSEC Checker** — Checks a domain's DNSSEC posture via DNS-over-HTTPS and returns whether DNSKEY, DS record, and resolver authentication (AD flag) are present, plus advisory warnings.

*Use when:* Use when an agent needs to verify whether a domain has DNSSEC enabled, whether the parent zone publishes a DS record, and whether the resolver authenticated the response — for example, during a domain security audit or pre-deployment DNS validation.

*Not for:* Do not use for IP literals, localhost, or reserved suffixes like .local or .internal — those return 400. Not suitable for real-time DNS monitoring or streaming; this is a single-shot check per call.

**Inputs:**

- `domain` (string, required) — Bare domain name to check for DNSSEC signing. IP literals, localhost, and reserved suffixes (.local, .internal) are rejected with 400.

**Returns:** Returns domain, dnssec_enabled, has_ds, authenticated (all true for example.com), an empty warnings array, and a queried_at UTC timestamp.

**Example:** `GET https://dns.use.x402atlas.com/dnssec?domain=example.com`

---