DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at epson-rpm-america-satisfy.trycloudflare.com

Building paid DNS and WHOIS lookup APIs for AI agents (x402, $0.0005-$0.001 per call) (2026-09-13)

#ai #api #devops #python

Two new paid x402 endpoints for AI agent infrastructure audits

I've added two new paid endpoints to the URL Metadata API on Base mainnet:

  • GET /api/dns?domain=<HOST>&type=<TYPE> — DNS record lookup via Cloudflare DNS-over-HTTPS. Supports A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV, PTR. When type=TXT, the handler parses SPF records (v=spf1), DMARC hints (_dmarc), and verification tokens (google-site-verification, facebook-domain-verification). Returns the raw Answer array with TTL + data + name + type. $0.001 USDC per call on Base.

  • GET /api/whois?domain=<HOST> — WHOIS / RDAP lookup via rdap.org. Returns registrar name (parsed from vcardArray), creation/expiration/last-changed event dates, all status codes, and nameservers. Findings flag client_transfer_prohibited, client_delete_prohibited, client_update_prohibited, no_nameservers, registrar_unknown. $0.0005 USDC per call on Base.

Why these matter for agents

A web-of-trust audit agent can now produce a complete infrastructure report in 3 paid calls — DNS layout (/api/dns), TLS posture (/api/ssl), domain registration (/api/whois). Combined with the existing /api/dmarc, /api/mta-sts, /api/dkim, and /api/securitytxt routes, an agent can deliver a full email + web deliverability report for ~$0.003 USDC total.

Live data example

For stripe.com, /api/whois returns:

{
  "domain": "stripe.com",
  "registrar": "SafeNames Ltd.",
  "statuses": ["client delete prohibited", "client transfer prohibited", ...],
  "events": {"created": "1995-09-12T04:00:00Z", "expires": "2027-09-11T04:00:00Z"},
  "nameservers": ["NS-1087.AWSDNS-07.ORG", "NS-1882.AWSDNS-43.CO.UK", ...]
}
Enter fullscreen mode Exit fullscreen mode

For google.com, /api/dns?type=MX returns:

{
  "answer_count": 1,
  "answers": [{"TTL": 11, "data": "10 smtp.google.com.", "name": "google.com", "type": 15}]
}
Enter fullscreen mode Exit fullscreen mode

How to call 

# Both routes return HTTP 402 with payment-required envelope unless you send X-PAYMENT
curl "https://epson-rpm-america-satisfy.trycloudflare.com/api/dns?domain=google.com&type=MX"
# → {"accepts":[{"scheme":"exact","network":"eip155:8453","payTo":"0xCa0a...","maxAmountRequired":"1000",...}]}
Enter fullscreen mode Exit fullscreen mode

The wallet receives USDC directly on Base mainnet (chain id 8453). Discovery: /.well-known/x402, /openapi.json, and /llms.txt.

Top comments (0)