DomainDNSCheck

CAA Record Checker

Enter a domain or hostname to find the CAA records that apply to it and see which certificate authorities are allowed to issue certificates.

  • DNS
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

At a glance

What it checks
See which certificate authorities a domain allows to issue SSL/TLS certificates, including wildcard rules.
Data source
CAA records found by climbing from the name to its parent domains, as certificate authorities do.
Freshness
Live check; results are cached for up to 5 minutes
Limits
CAA only affects new certificate issuance, never certificates that already exist. Methodology
Cost
Free, no account needed

Understanding the result

What CAA records do

A Certification Authority Authorization (CAA) record lists the certificate authorities (CAs) that may issue certificates for a domain. Publicly trusted CAs are required to check CAA before issuing, and must refuse if they are not listed. CAA therefore limits the damage if an attacker tricks a CA you do not use into issuing a certificate.

A typical set looks like this:

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild ";"
example.com.  CAA  0 iodef "mailto:[email protected]"

This allows one CA to issue normal certificates, forbids wildcard certificates entirely and asks CAs to report refused requests to an email address.

How the checker finds the relevant records

CAA is inherited. When a CA checks shop.example.com, it first looks for CAA records on that exact name and, if there are none, moves up one label at a time. The checker follows the same approach, climbing from the hostname you enter toward the registrable domain and stopping at the first name that has CAA records. The result shows where the records were found, the parsed flag, tag and value of each record, and a summary of allowed issuers and wildcard issuers.

Reading the findings

  • INFO, no CAA records: any publicly trusted CA may issue for the domain. This is the default and not an error, but adding CAA is a simple hardening step.
  • PASS, records found: the allowed issuers are listed. If the only issue value is ;, no CA may issue at all, which is useful for domains that never serve HTTPS.
  • WARNING, unknown critical tag: a record has the critical flag (128) set on a tag CAs do not recognize. CAs must refuse to issue in that case, which can block renewals unexpectedly.
  • iodef PASS or INFO: whether a reporting address is published. It is optional.

Avoiding renewal failures

The most common CAA problem is a certificate renewal that suddenly fails after a hosting or CDN change, because the new provider uses a CA that is not listed. Before switching providers, find out which CA they use and add its identifier. If you use more than one CA, list each in its own issue record. After changing CAA, confirm the served certificate with the SSL Checker. How SSL certificates work explains issuance and validation in more detail.

Frequently asked questions

Do I need a CAA record?

No, it is optional. Without one, every publicly trusted CA may issue for your domain. Adding it reduces the number of CAs that could mistakenly issue a certificate for you.

Does CAA affect certificates I already have?

No. CAs check CAA only at the moment of issuance. Existing certificates remain valid until they expire, but their renewals will be subject to the new records.

What value do I use for my certificate authority?

Each CA documents the domain name to use in its CAA records, for example letsencrypt.org. Check your CA's documentation rather than guessing, since the value is not always the same as its website address.

Why does a subdomain show the parent domain's records?

Because CAA is inherited. If the subdomain has no CAA records of its own, the parent's records apply, and the checker shows where they were found.