DNS Inspector via x402 Wire v2: A Technical Tutorial

DNS Inspector resolves A/AAAA/CNAME/NS/MX/TXT/SOA/CAA records for a domain and evaluates its SPF and DMARC posture — useful for an agent that needs to verify a counterparty domain actually exists and is configured sanely before trusting anything else about it. This is a tutorial for its x402 wire v2 endpoint specifically.

The Endpoint

POST /api/v1/dns-inspector/x402-v2
Price: $0.02 per call
Body: { "url": "<domain or URL to look up>" }

The 402 Challenge

Call it with no payment and you get a real, live x402 v2 challenge back — the payment terms live in the base64-encoded PAYMENT-REQUIRED response header, not the JSON body:

curl -i -X POST https://contextiq.trango-compute.com/api/v1/dns-inspector/x402-v2 \
  -H "Content-Type: application/json" \
  -d '{"url":"example.com"}'

Decoded, the header contains:

{
  "x402Version": 2,
  "resource": { "url": "https://contextiq.trango-compute.com/api/v1/dns-inspector/x402-v2" },
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:8453",
    "amount": "20000",
    "payTo": "0x4eba5ea3cf0f3fc307099317e17e54390f7a4c58",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": { "name": "USD Coin", "version": "2" }
  }],
  "extensions": {
    "bazaar": {
      "info": {
        "input": { "type": "http", "method": "POST", "schema": { "properties": { "url": { "type": "string" } }, "required": ["url"] } }
      }
    }
  }
}

network: "eip155:8453" is the CAIP-2 identifier for Base mainnet — v2's replacement for v1's bare "base" string. amount (not v1's maxAmountRequired) is 20,000 atomic units of a 6-decimal token, $0.02 USDC.

Option A: API Key

curl -X POST https://contextiq.trango-compute.com/api/v1/dns-inspector/x402-v2 \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"url":"example.com"}'

Option B: Pay With x402, No API Key

npm install @x402/fetch @x402/evm

import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { base } from "viem/chains";
import { wrapFetchWithPayment } from "@x402/fetch";

const account = privateKeyToAccount(process.env.WALLET_PRIVATE_KEY as `0x${string}`);
const client = createWalletClient({ account, transport: http(), chain: base });
const fetchWithPayment = wrapFetchWithPayment(fetch, client);

const res = await fetchWithPayment("https://contextiq.trango-compute.com/api/v1/dns-inspector/x402-v2", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ url: "example.com" }),
});

console.log(await res.json());

The Response

{
  "domain": "example.com",
  "found": true,
  "records": { "A": [{ "value": "93.184.216.34", "ttl": 300 }], "AAAA": [], "CNAME": [], "NS": [], "MX": [], "TXT": [], "SOA": null, "CAA": [] },
  "spf": { "found": true, "record": "v=spf1 -all" },
  "dmarc": { "found": true, "policy": "reject" },
  "caaVerdict": "unrestricted",
  "providers": { "dnsHost": "Cloudflare", "mailProvider": null },
  "connectedServices": []
}

spf.record is the raw SPF TXT record if one exists; dmarc.policy is reject, quarantine, none, or absent entirely if no DMARC record is published — none/absent is the common case, and it means the domain has DMARC monitoring at best, no actual enforcement. caaVerdict is restricted (a CAA record limits which certificate authorities can issue for the domain) or unrestricted (no CAA record, any CA can issue). None of these fields are pass/fail on their own — a domain with no SPF or DMARC isn't necessarily malicious, but it's a data point worth weighing alongside everything else you know about a counterparty.

Try It

DNS Inspector is free to use from the dashboard for one-off lookups, or callable via the API above for wiring domain-hygiene checks into an automated pipeline.