CAA Lookup
Check the CAA records of a domain to see which certificate authorities are authorised to issue certificates for it, for wildcards too, and where violations are reported.
- Runs on our servers
- Free to use
- API available →
About this tool
Anyone who can pass a domain-validation challenge can obtain a certificate from any public CA, unless the domain says otherwise. CAA records are that statement: they name the authorities allowed to issue, separately for wildcards, and an address where violations should be reported. The CAA Lookup fetches the records, shows every tag with its value and flag, counts the authorised CAs and explains the semantics, so you can verify a policy before a renewal fails or publish one to protect the domain.
See the certificate deployed with the SSL Certificate Check.
How to use it — quick steps
- 01
Enter the domain or hostname
Type or paste the domain or hostname in the field above, for example example.com. Use Ctrl + V to paste.
- 02
Press "Lookup CAA records"
Press "Lookup CAA records" or Ctrl + Enter. The result appears below in a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
Issuance policy at a glance
issue, issuewild and iodef tags with their values, the critical flag and a count of authorised CAs.
Live DNS answer
The records are fetched through the APIVoid DNS Lookup API, so you see what certificate authorities see.
Tags explained
A short legend under the table explains what each tag and flag means (e.g. issue, issuewild, iodef and Flag 128).
Frequently asked questions
What is a CAA record?
Certification Authority Authorization: a DNS record listing the CAs allowed to issue certificates for the domain. CAs are required to check it before issuing, so it blocks mis-issuance by any authority you did not list.
My domain has no CAA records, is that a problem?
Not an error: without CAA any CA may issue. Adding records (for example issue "letsencrypt.org") is a cheap hardening step.
What does issue ";" mean?
An empty issuer means no certificate authority may issue certificates for the domain under the specified tag, unless another applicable CAA record permits it.
Does CAA apply to subdomains?
CAs look for CAA records on the exact name and then climb towards the root, so a record on the domain covers subdomains unless they publish their own.