CAA Record Lookup

Check which certificate authorities are permitted to issue SSL certificates for a domain.

>_
Enter a domain to check CAA records
Results will show authorized certificate authorities

What a CAA record does

A CAA (Certification Authority Authorization) record names which certificate authorities are allowed to issue certificates for your domain. Every public CA is required to check it before issuing.

If you publish no CAA record, any CA may issue — which is the default for most domains. If you publish one, only the CAs you list may issue. That is the point: it stops a mis-issued or fraudulently obtained certificate from a CA you never intended to use.

A record looks like 0 issue "letsencrypt.org". The 0 is the flags field, issue is the tag, and the value is the CA's identifying domain.

Before you add one

CAA records are easy to get wrong in a way that only surfaces at renewal, months later.

  • List every CA you actually use, including the one your host or CDN issues through. Cloudflare, AWS and many managed hosts request certificates on your behalf.
  • Use issuewild if you need wildcard certificates — a plain issue tag does not authorize wildcards at every CA.
  • Add iodef with a mailto address to be notified when a CA is asked to issue against policy.
  • CAA is checked at the closest parent with a record, so a record on the apex applies to subdomains unless overridden.