---
title: "MERCURY Cited DNS Snapshot"
method: GET
path: "/buy/dns"
tags: ["cited-dns", "dns", "dns-records", "dns-snapshot", "mx-records", "spf", "dmarc", "nameservers", "domain-audit", "dns-hijack-evidence", "vendor-risk", "attestation", "provenance", "verifiable-data-record", "agent-native", "keyless", "data-feed"]
---

# MERCURY Cited DNS Snapshot

`GET /buy/dns`

## Request

- Base URL: `https://network.mercury-hq.com`
- URL: `https://network.mercury-hq.com/buy/dns`
- Auth: none declared
- TypeScript: <https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront/docs/buy/dns/get.ts> (a function with typed inputs; its response is checked against the schema)

Domain → a SIGNED, timestamped DNS snapshot (A, AAAA, MX, NS, TXT, CNAME, SOA), normalised + sorted into a byte-stable record set with an offline-verifiable provenance receipt — proving exactly what the zone resolved to at that moment. Keyless, no LLM, no signup. (Normalisation is deterministic; DNS itself is mutable across time/TTL/geo — which is the very reason the snapshot is timestamped + signed.)

## Query parameters

- `domain` string: the domain to resolve (e.g. example.com). A full URL is also accepted; its hostname is used.
- `url` string: alternative to ?domain= — any http/https URL; the registrable hostname is resolved.

## Response `200`

Delivered after the x402 payment settles on Base mainnet.

- object
  - `ok` boolean, required: true on success; false on an honest failure (never charged for a stub)
  - `url` string, required: the resolved domain (echoed in the `url` field for gate uniformity)
  - `domain` string: the normalised, lower-cased, trailing-dot-stripped domain that was resolved
  - `status` integer: 200 on a successful resolve (HTTP-shaped status for gate uniformity)
  - `text` string: canonical sorted-key JSON of `data` — the exact string the receipt signs over
  - `resolvedAt` string: ISO-8601 resolve time (provenance metadata; binds WHEN the snapshot was taken)
  - `fetchedAt` string: alias of resolvedAt for gate/receipt uniformity
  - `data` object: the deterministic, normalised DNS snapshot
    - `domain` string
    - `resolver` union: pinned resolver IPs used, or 'system'
      - string[]
      - string
    - `records` object: normalised record sets keyed by type (A, AAAA, MX, NS, TXT, CNAME, SOA); sorted + de-duplicated
      - `A` string[]
      - `AAAA` string[]
      - `MX` object[]
        - `priority` integer
        - `exchange` string
      - `NS` string[]
      - `TXT` string[]
      - `CNAME` string[]
      - `SOA` object, nullable
        - `nsname` string
        - `hostmaster` string
        - `serial` integer
        - `refresh` integer
        - `retry` integer
        - `expire` integer
        - `minttl` integer
    - `summary` object: record counts per type (derived, deterministic)
    - `flags` object: derived convenience flags (hasSpf, hasDmarc) pointing into TXT
    - `partialErrors` object: present only if a record type had a transport error; never fabricated data
    - `snapshot` string: rubric/version tag: mercury-cited-dns-v1
  - `error` string: present only when ok:false

## Other responses

- `402`: Payment Required — retry with an x402-signed payment (e.g. x402-fetch). Terms are in the challenge body (x402 v1).

---

[API](https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront.md) - [All operations](https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront/llms.txt) - [OpenAPI document](https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront/revisions/211aa7db24ae?raw)