Skip to main content
WebTools

CAA record checker

See which certificate authorities a domain allows to issue its certificates.

Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.

What we check

We look for CAA records on the name you enter. If there are none, we check its parent names, as certificate authorities do (RFC 8659), and show the records that apply. We explain each record, show which certificate authorities may issue ordinary and wildcard certificates, and point out mistakes.

Common tags

Frequently asked questions

What is a CAA record?

A DNS record that lists the certificate authorities (CAs) allowed to issue certificates for a domain. Every public CA must check it before issuing, and refuse if it isn't listed.

What happens if a domain has no CAA records?

Any public certificate authority may issue certificates for it. That is allowed, but a CAA record reduces the risk of a certificate being issued by mistake or by an attacker.

Why were the records found on a different name?

If a name has no CAA records, CAs check its parent, then the parent's parent. So records on example.com also apply to www.example.com unless www has its own.

What is the difference between issue and issuewild?

"issue" lists CAs for ordinary certificates. "issuewild" lists CAs for wildcard certificates (*.example.com); if there is no issuewild record, the issue records apply to wildcards too.

Does a CAA record affect certificates that already exist?

No. CAs check CAA only when they issue. Existing certificates stay valid until they expire or are revoked.

Related tools

  • SSL Certificate Checker

    Check whether a site's HTTPS certificate is valid and trusted, which names it covers, and when it expires.

  • DNSSEC Checker

    Check whether a domain is signed with DNSSEC and whether validating resolvers accept it.

  • DNS Lookup

    Look up the DNS records published for a domain, one type or all common types at once, or the reverse DNS name of an IP address.

  • Website Health Check

    Run the main website, DNS and email checks on one site at once and get a short report, area by area, with links to the full results.