What is a CAA record?

A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are allowed to issue TLS/SSL certificates for your domain. Each record names an authorized CA by its domain (for example "letsencrypt.org").

How do I use this tool?

Enter a domain name and the tool queries its CAA records server-side and displays them in plain form. It shows the tags (issue, issuewild, iodef) and the CA identifiers, so you can see at a glance which authorities are permitted to issue certificates.

Why do CAA records matter?

They reduce the risk of mis-issued certificates by restricting which CAs can validate and issue for your domain, and any compliant CA must check CAA before issuing. This is a lightweight but meaningful defense against unauthorized or fraudulent certificates.

How do I read the result?

An "issue" tag controls normal certificates, "issuewild" controls wildcard certificates, and "iodef" gives a contact URL or mailto for violation reports. A value of ";" means no CA is allowed to issue for that scope.

What is a common gotcha with CAA records?

Having no CAA record is not a failure; it simply means any CA may issue, so an empty result is normal for many domains. Also, CAA is checked at the exact name and its parent domains, so a record on the apex generally covers subdomains unless a more specific one overrides it.

CAA Record Look Up

Related tools

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

CAA records whitelist which certificate authorities may issue TLS certificates for the domain. CAs are required to check CAA before issuing; a CA not on the list must refuse.

How to read your result

No CAA record means any CA may issue (the pre-CAA default — common and acceptable). If records exist, make sure every CA you actually use is listed, including ones used indirectly by your CDN or hosting platform.

Common problems and how to fix them

CAA blocks the CA your automation uses

How it shows up: Certificate renewal suddenly fails — Let's Encrypt or your CDN reports a CAA error — and the site shows an expired-certificate warning once the old cert lapses.

How to fix it: Add an issue entry for the CA, e.g. 0 issue "letsencrypt.org", alongside existing entries. Remember platforms like Cloudflare or Netlify issue via their own CA partners — check their docs for which CAA entries they need.

CAA present on a subdomain's parent contradicts what the subdomain needs

How it shows up: Certificates issue fine for the main site but fail for a subdomain hosted on a different platform.

How to fix it: CAA is inherited from the closest ancestor that has one. Either extend the parent's CAA to include the subdomain's CA, or set a specific CAA record on the subdomain itself, which overrides the parent for that name.

Frequently asked questions

What is a CAA record?: A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are allowed to issue TLS/SSL certificates for your domain. Each record names an authorized CA by its domain (for example "letsencrypt.org").
How do I use this tool?: Enter a domain name and the tool queries its CAA records server-side and displays them in plain form. It shows the tags (issue, issuewild, iodef) and the CA identifiers, so you can see at a glance which authorities are permitted to issue certificates.
Why do CAA records matter?: They reduce the risk of mis-issued certificates by restricting which CAs can validate and issue for your domain, and any compliant CA must check CAA before issuing. This is a lightweight but meaningful defense against unauthorized or fraudulent certificates.
How do I read the result?: An "issue" tag controls normal certificates, "issuewild" controls wildcard certificates, and "iodef" gives a contact URL or mailto for violation reports. A value of ";" means no CA is allowed to issue for that scope.
What is a common gotcha with CAA records?: Having no CAA record is not a failure; it simply means any CA may issue, so an empty result is normal for many domains. Also, CAA is checked at the exact name and its parent domains, so a record on the apex generally covers subdomains unless a more specific one overrides it.