DNS

CAA Record Lookup

CA Authorization

Check a domain's CAA policy

We'll query authoritative nameservers for CAA records and evaluate which Certificate Authorities are permitted to issue certs.

DNS Resolver

Most domains return the same records on every resolver — the choice matters during DNS propagation, or when a filtering resolver blocks a domain.

No CAA lookup results yet

Enter a domain above and click Check CAA Records to see its certificate authority policy here.

Tool features

Comprehensive CAA record analysis and SSL certificate security validation
4 checks

CAA Record Lookup

Find Certificate Authority Authorization records

SSL Security

Verify certificate authority authorization settings

Policy Analysis

View CA restrictions and issuance policies

Export Options

Download a branded PDF report, or export as CSV / JSON

What is a CAA record & how it works

How a domain restricts certificate issuance

A CAA (Certification Authority Authorization) record is a DNS record that lists which Certificate Authorities are permitted to issue TLS/SSL certificates for a domain. Before issuing a certificate, a compliant CA is required to check the domain's CAA policy and refuse if it isn't authorised.

This lookup reads the CAA records published for the domain, shows every issue, issuewild and iodef property, and flags whether certificate issuance is restricted or open to any authority — a domain with no CAA record lets any CA issue certificates.

issue
Names a CA allowed to issue certificates for the domain.
issuewild
Restricts which CAs may issue wildcard (*.example.com) certificates.
iodef
A contact URL where CAs report requests that violate the policy.

How to use this tool

Check a domain's CAA policy in four steps
1
Enter a domain
Type a domain, e.g. example.com. CAA is checked at the registrable domain and inherited by subdomains.
2
Pick a resolver (optional)
Open Advanced Settings to query a specific public resolver such as Google (8.8.8.8) or Cloudflare (1.1.1.1).
3
Run the lookup
Click Check CAA Records to read the domain's certificate-authority authorization policy from DNS.
4
Review the results
See which CAs are permitted, whether wildcards are restricted, and read the diagnostics and recommendations.

Related tools

Keep debugging with tools from the same suite
5 tools
CAA Generator
Generate CAA records to control which certificate authorities can issue SSL/TLS certificates for your domain
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
TXT Lookup
Retrieve TXT records including SPF, DKIM, DMARC, and verification records
DNS Lookup
Perform DNS queries for A, AAAA, MX, TXT, CNAME, and other DNS record types
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail

Frequently asked questions

Common questions about CAA records
5 Q&A

A CAA (Certification Authority Authorization) record tells Certificate Authorities which of them are allowed to issue TLS/SSL certificates for your domain. CAs must honour it before issuing.

It is optional but recommended. Without one, any CA may issue certificates for your domain. A CAA record limits issuance to the authorities you trust, reducing the risk of mis-issuance.

If no CAA records are found, the domain does not restrict certificate issuance — any publicly trusted CA may issue certificates for it. This is valid but less secure than an explicit policy.

The issue property controls who may issue normal certificates; issuewild specifically controls wildcard (*.example.com) certificates. If issuewild is absent, the issue policy applies to wildcards too.

CAA records are read at issuance time, so a change applies to the next certificate request once DNS has propagated — governed by the record's TTL, typically minutes to a few hours.