CAA Record Checker
See which certificate authorities are allowed to issue for a domain.
The domain to look up
How this lookup works
A CAA record lists the certificate authorities allowed to issue certificates for a domain. Every compliant CA is required to check it before issuing. This tool retrieves the records so you can see, and confirm, which CAs you have authorised.
What the results mean
- issue
- A CA authorised to issue standard certificates for the domain.
- issuewild
- A CA authorised to issue wildcard certificates specifically.
- No CAA records
- Normal and common. Without a CAA record, any CA may issue — the record is a restriction you opt into, not a requirement.
Common problems and fixes
- My certificate authority refuses to issue and blames CAA
- The CA is not in your record, or the record sits at a level it does not check. CAA is inherited down the tree, so a record on example.com governs shop.example.com unless that name has its own. Add the CA's documented identifier exactly as they publish it — "letsencrypt.org", not a guess at their name.
- A wildcard certificate fails while ordinary ones succeed
- issue and issuewild are separate permissions, and an issuewild record overrides issue for wildcards entirely. If you have published issuewild for one CA, no other CA can issue a wildcard even if it holds an issue record. Add an explicit issuewild entry for the CA you are using.
- I added the CA but issuance still fails
- A resolver serves the cached answer until the record’s TTL expires, and the certificate authority is querying a resolver too — so a CAA change made minutes before ordering has very likely not reached them. CAA records commonly carry long TTLs because they change rarely. Wait out the TTL you had set before the edit, then retry the order.
Frequently asked questions
Do I need a CAA record?
It is optional but worthwhile. Without one, any certificate authority in the world can issue a certificate for your domain. A CAA record limits that to the CAs you actually use, which reduces the risk of a mis-issued or fraudulent certificate. It is a low-effort hardening step.
Does a CAA record make my certificates more secure?
It does not change the certificate itself. What it does is reduce the number of parties who can issue one for your domain from every public CA in the world to the ones you named — which narrows the blast radius if a CA is compromised or tricked. It is a cheap hardening step rather than a protection against an attacker who already controls your DNS.
What does the iodef tag do?
It publishes a contact address for a CA to notify when it receives a request that a CAA record forbids. Support is inconsistent — some CAs honour it and some ignore it — so treat any report you get as a bonus rather than as monitoring. It costs nothing to publish alongside your issue records.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/caa-lookup/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="CAA Record Checker" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/caa-lookup/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.