CAA Checker
Look up Certificate Authority Authorization records.
Enter a domain to look up its CAA records and see which certificate authorities are allowed to issue TLS certificates for it. We read the live records straight from DNS over an encrypted connection. Nothing is stored.
This tool looks up the CAA (Certification Authority Authorization) records for a domain. A CAA record tells the public web PKI which certificate authorities are permitted to issue TLS certificates for your domain. Defined in RFC 8659, CAA is checked by every compliant CA at issuance time, so it is a simple but effective control against an unauthorised or mistakenly-issued certificate being created in your name.
What a CAA record contains
Each record has a flags byte, a tag, and a value. The common tags are issue (authorises a CA to issue normal certificates), issuewild (controls wildcard certificates specifically), and iodef (a contact URL or mailto where a CA can report policy-violation attempts). The value of an issue tag is the CA's domain, for example letsencrypt.org or digicert.com. A flag of 128 marks the tag as critical, meaning a CA that does not understand it must refuse to issue.
How to read the result and fix problems
If no CAA records are present, any CA may issue for your domain. That is the permissive default rather than an error, but publishing CAA tightens control. If records exist, confirm every CA you actually use is listed; a missing entry will block legitimate renewals. To forbid all issuance, publish 0 issue ";". CAA records are inherited down the tree, so a record on the apex applies to subdomains unless a closer label overrides it. Always include an iodef address so you are notified of attempted violations. CAA protects the certificates that underpin MTA-STS and HTTPS; explore the rest of our tools for full coverage.
Frequently asked questions
What happens if my domain has no CAA records?
Nothing breaks. The absence of CAA means any certificate authority is permitted to issue, which is the default. Publishing CAA simply restricts issuance to the CAs you name, reducing the chance of an unauthorised certificate.
Why did my certificate renewal suddenly fail with a CAA error?
Almost always because the CA you renewed with is not listed in your issue (or issuewild) records. Add an issue record naming that CA's domain, for example 0 issue "letsencrypt.org", then retry the renewal.
What is the difference between issue and issuewild?
The issue tag authorises a CA to issue ordinary certificates, while issuewild controls wildcard certificates specifically. If issuewild is present it overrides issue for wildcards, so a CA allowed for normal certificates may still be blocked from issuing a wildcard unless listed under issuewild.
How do I block all certificate issuance for a domain?
Publish a record with an empty value: 0 issue ";". The semicolon tells every compliant CA that no authority is permitted to issue, which is useful for domains that should never have a certificate.
Do CAA records apply to subdomains?
Yes. A CA looks for CAA at the requested name and walks up the tree, so a record on your apex covers subdomains unless a closer label publishes its own CAA set, which then takes precedence for that branch.
What is the iodef tag for?
The iodef tag gives a CA a contact, a mailto: or HTTPS URL, to report attempts to obtain a certificate that your CAA policy forbids. Including one means you get alerted to suspicious issuance attempts against your domain.