CAA Record Lookup

Find Certification Authority Authorization (CAA) records that restrict which CAs can issue SSL/TLS certificates for a domain.

About CAA Records & Security

Certification Authority Authorization (CAA) is a DNS record that allows domain owners to declare which Certificate Authorities (CAs) are permitted to issue SSL certificates for the domain.

Security Benefit: If a hacker compromises your domain infrastructure or social engineers a CA, CAA records prevent unauthorized CAs from issuing fraudulent certificates for your domain. As of 2017, all public CAs are required to check CAA records before issuing certificates.

Our CAA Record Lookup shows which certificate authorities are permitted to issue SSL/TLS certificates for a domain. Publishing CAA records is a simple, high-impact control that blocks unauthorised certificate issuance — and this tool confirms yours are in place and correctly formed.

What is a CAA Record?

A CAA (Certification Authority Authorization) record is a DNS record that names which certificate authorities are allowed to issue certificates for your domain. It is defined in RFC 8659.

Since September 2017, the CA/Browser Forum has required every publicly trusted certificate authority to check CAA records before issuing. If your domain publishes a CAA record and the requesting CA is not listed, the CA must refuse to issue — regardless of whether the requester passed domain validation.

Without a CAA record, any of the hundreds of trusted certificate authorities in the world may issue a certificate for your domain. With one, you reduce that set to the authorities you actually use.

Names which certificate authorities may issue certificates for your domain
Mandatory for all public CAs to honour since September 2017
Defined in RFC 8659 with three property tags: issue, issuewild and iodef
Applies to a domain and, by inheritance, to its subdomains
Takes effect immediately with no certificate reissuance required

Why CAA Records Matter

Every trusted certificate authority in the world can, by default, issue a valid certificate for your domain. A mis-issued certificate lets an attacker present a technically valid HTTPS identity for your site — enabling convincing phishing and interception that browsers will not warn about.

CAA records close most of that exposure in a single DNS entry. They cost nothing, require no changes to your servers, and take effect the moment they propagate. For the level of effort involved, they are one of the highest-value security controls available to a domain owner.

Reduces the set of CAs that can issue for you from hundreds to the ones you chose
Blocks mis-issuance from a compromised or negligent certificate authority
The iodef tag delivers an alert when an unauthorised issuance is attempted
Costs nothing and requires no server-side changes
Increasingly expected in security audits and compliance reviews

How This CAA Record Lookup Works

The tool queries DNS for CAA records on the supplied domain and parses each property tag.

Validates the domain input against format and SSRF safety checks
Queries authoritative DNS for records of type CAA
Parses the flags byte, property tag and value of each record
Identifies which certificate authorities are authorised
Flags domains with no CAA record as open to issuance by any CA

How to Use the CAA Record Lookup

Enter a domain name such as example.com in the input field
Run the lookup to query live DNS
Review which certificate authorities are authorised by the issue tag
Check whether wildcard issuance is separately restricted by issuewild
Confirm an iodef address is set so you are notified of blocked attempts

Understanding Your CAA Record Results

Each CAA record has a flags byte, a property tag and a value. Here is what they mean:

Field / Value	Meaning
`issue`	Names a CA authorised to issue standard certificates, identified by its domain — for example letsencrypt.org or digicert.com. Multiple issue records are permitted.
`issuewild`	Controls wildcard certificate issuance specifically. If absent, wildcard rules fall back to the issue tag. Set issuewild to ";" to block wildcards entirely.
`iodef`	A mailto: or https: endpoint where CAs report blocked issuance attempts. This is your early warning that someone tried to obtain a certificate for your domain.
`Flags`	Usually 0. A value of 128 sets the critical bit, meaning a CA that does not understand the tag must refuse to issue rather than ignore it.
`Value ";"`	A semicolon as the value means no certificate authority is authorised. Used with issuewild to forbid wildcard certificates while still permitting normal ones.
`No record`	Any publicly trusted certificate authority may issue for your domain. This is the default state and leaves the widest possible issuance surface.

Common Problems & How to Fix Them

Any of the hundreds of trusted certificate authorities can issue a certificate for your domain.

Add CAA records naming only the CAs you actually use:
Type: CAA, Name: @, Flags: 0, Tag: issue, Value: letsencrypt.org

Add one record per authorised CA, plus an iodef record with a mailto: address so you are notified of blocked attempts.

A CAA record is blocking the CA you are trying to use. This commonly happens after switching certificate providers, or when a CDN attempts to issue a certificate on your behalf.

Identify the CA identifier the new provider requires — Let's Encrypt uses letsencrypt.org, DigiCert uses digicert.com, Google Trust Services uses pki.goog — and add a matching issue record. Note that CAA is checked at issuance time, so existing certificates keep working.

When an issuewild record exists, it completely overrides the issue tag for wildcard requests. An issuewild record naming a different CA, or set to ";", blocks wildcard issuance even if issue permits that CA.

Either add an issuewild record naming the CA you want, or remove the issuewild record so wildcard requests fall back to the issue rules.

CAA lookup walks up the DNS tree from the requested name. The first ancestor with any CAA record wins, and the search stops there.

If a CAA record exists at the root, a subdomain with no record inherits the root policy. To apply different rules to a subdomain, publish a complete CAA record set at that subdomain — partial sets are not merged with the parent.

Best Practices

Publish CAA records naming only the certificate authorities you actually use
Always include an iodef record so you are alerted to blocked issuance attempts
Add an issuewild record set to ";" if you never need wildcard certificates
Update CAA records before switching certificate providers, not after
Remember that CAA is checked only at issuance — existing certificates are unaffected
Include your CDN or load balancer CA if it issues certificates on your behalf
Review CAA records whenever your certificate infrastructure changes

Security Recommendations

Treat a missing CAA record as an open issuance surface across every publicly trusted CA in the world
Set the iodef tag to a monitored mailbox — a blocked issuance attempt is a genuine attack signal worth investigating
Pair CAA with Certificate Transparency log monitoring, since CAA prevents issuance while CT detects it
Restrict wildcard issuance explicitly; a leaked wildcard certificate compromises every subdomain at once
Review CAA records after any DNS provider migration, as they are frequently lost in zone transfers
Keep the authorised CA list minimal — each additional authority widens the trust surface

Frequently Asked Questions

A CAA record is a DNS record that specifies which certificate authorities are permitted to issue SSL/TLS certificates for your domain. Since September 2017, all publicly trusted CAs are required to check CAA records and refuse issuance if they are not listed.

It is not required for HTTPS to work, but it is strongly recommended. Without one, any trusted certificate authority in the world can issue a certificate for your domain. A CAA record reduces that to the authorities you have chosen, at no cost and with no server-side changes.

No. CAA is checked only when a certificate is issued or renewed, never when a browser validates one. Existing certificates continue to work normally. The effect appears at the next renewal, which is why you should update CAA records before switching providers.

Use letsencrypt.org. Other common values are digicert.com for DigiCert, sectigo.com for Sectigo, pki.goog for Google Trust Services, and amazon.com or amazontrust.com for AWS Certificate Manager. Always check your provider documentation for the exact string.

A CA checks the exact name first, then walks up the DNS tree. The first ancestor with any CAA record determines the policy and the search stops there. A subdomain with no CAA record inherits the parent policy; a subdomain with its own record replaces it entirely rather than merging.

The iodef tag gives certificate authorities an address — a mailto: or https: endpoint — to report blocked issuance attempts. It turns CAA from a silent control into an alerting one, telling you when someone tried to obtain a certificate for your domain and was refused.

Yes. Publish a single record with the issue tag and a value of ";" — a semicolon. This authorises no certificate authority at all. It is appropriate for parked domains and internal-only names that should never have a public certificate.