Free CAA Lookup
Enter a domain or subdomain to see which certificate authorities are allowed to issue for it, and which name that rule actually comes from.
Reading CAA records...
Could not check
This name has no CAA records of its own. The set below comes from
- May issue (issue)
- May issue wildcards (issuewild)
- Reports go to (iodef)
No CAA records were found on this name or its parents.
What a CAA Lookup Tells You
A CAA lookup reads the Certification Authority Authorization records for a name. They list which certificate authorities may issue SSL/TLS certificates for it, and public CAs must check them before issuing.
A subdomain with no CAA record of its own is covered by the closest parent that has one, so this tool climbs from the name you enter up to the registrable domain and shows where the rule came from. CAA only governs new issuance. To inspect the certificate a site is using today, run the SSL certificate checker.
- Enter the domain or subdomain you want a certificate for.
- We ask a public resolver for CAA records at that name, then at each parent until a set is found.
- Read which authorities may issue, for standard and for wildcard certificates.
- If a certificate request was refused, compare your CA's domain with the list.
What this check settles
- Which CAs may issue: the domains named in issue tags, and nobody else.
- Whether wildcards differ: issuewild, when present, overrides issue for wildcard certificates.
- Which record applies: the one on this name, or the one inherited from a parent.
CAA Tags Explained
A CAA record is a flag, a tag and a value. These are the three tags defined by RFC 8659.
| Tag | What it controls | Example and meaning | Applies to |
|---|---|---|---|
| issue | Who may issue certificates | 0 issue "letsencrypt.org" allows Let's Encrypt. Add one record per CA. A value of ";" allows nobody. | All certificates |
| issuewild | Who may issue wildcards | When present, it replaces issue for wildcard requests such as *.example.com. When absent, issue covers wildcards too. | Wildcards |
| iodef | Where to report refusals | 0 iodef "mailto:[email protected]" asks a CA to report a request that broke the policy. CAs are not required to send these. | Reporting |
How to Read the Result
The verdict comes first, then what the set allows and the records themselves.
The verdict
The headlineRestricted means named CAs only. Partly restricted means a set exists with no issue tag. Forbidden means no CA may issue. No CAA records means any public CA may.
The raw records
The sourceEach record as flag, tag and value. A flag of 128 marks a tag as critical, so a CA that does not understand the tag must refuse to issue.
What the set allows
The ruleThe CA domains from the issue and issuewild tags with any parameters removed, plus the reporting address if one is set.
Inherited records
The originIf the name has no records of its own, the page shows which parent supplied them. A CAA set on a subdomain replaces its parent's set instead of adding to it.
What a CAA Record Is
CAA is a DNS record that names the certificate authorities allowed to issue for a domain. Since September 2017, public CAs have been required to check it before issuing, so it works as a gate at the moment a certificate is requested.
It does not encrypt anything and browsers do not read it. Its job is to narrow down who can issue a valid certificate for your name, so a mistake or a fraudulent request at any other CA is refused.
How to Add CAA Without Breaking Renewals
The risk with CAA is forgetting a CA you already use, so start by finding them all.
A safe order of work:
- List every certificate in use, including those issued by your CDN or hosting platform.
- Publish one issue record for each CA, using the domain that CA documents.
- Add issuewild only if wildcards should come from a narrower set.
- Look the name up to confirm the set, then check propagation before the next renewal.
Where CAA Records Go Wrong
CAA failures show up at renewal, often long after the record changed. The common cases:
- A platform that issues on your behalf is not listed, so its automatic renewal is refused. Many CDNs and hosts use more than one CA, so check their documentation.
- A subdomain set that omits your CA. A set on a subdomain replaces the parent's rules for that name, so the parent's allowances stop applying.
- An issuewild tag that narrows wildcards unintentionally. Once one exists, the issue list no longer applies to wildcard requests.
- A CNAME on the name. CAs follow the alias, so the target's CAA can apply to your subdomain. A DNS lookup shows whether the name is an alias.
Why CAA Records Matter
Fewer ways to mis-issue
Without CAA, an attacker can try any public CA. With it, requests elsewhere are refused at the first check.
Failed renewals
A set that leaves out your CA means the next renewal is refused, and the site breaks when the old certificate expires.
A written CA policy
CAA records your approved CAs in a public, machine-checked place, and many security audits ask for it.
Reports on refused requests
An iodef address gives a CA somewhere to report a request that broke your policy, where the CA supports it.
Who Checks CAA Records
Usually someone with a refused certificate, or an audit to pass.
IT & DNS Admins
Debug a certificate request a CA refused, and confirm a new CA is allowed before switching.
For DNS monitoringSecurity Teams
Audit which CAs each domain allows, and limit them to the ones you actually use.
For IT & MSPsWeb & SEO Teams
Confirm a new subdomain on a hosted platform can get its certificate before launch day.
For marketersAgencies
Check a client's CAA set before moving their site to a host that issues its own certificates.
For agenciesRelated SSL & DNS Tools
CAA decides who may issue. These show what is live.
Check the certificate
See who issued the certificate in use today and when it expires.
SSL certificate checkerFull DNS lookup
See every record type on the name, including any CNAME that affects CAA.
Run a DNS lookupCheck propagation
Just changed CAA? Confirm that public resolvers see the new set.
Check propagationFrequently Asked Questions
Common questions about CAA records and how to check them.
How do I check a domain's CAA records?
Enter the domain or subdomain in the tool above. It reads the CAA set that applies, including one inherited from a parent, and lists the authorities allowed to issue. On the command line, dig CAA example.com shows the records on that exact name.
What happens if a domain has no CAA record?
Any public certificate authority may issue for it. CAA is optional, so a missing record is the default and blocks nothing.
Do subdomains inherit CAA records?
Yes. If a name has no CAA set, a CA moves up to its parent and uses the closest set it finds. A set on the subdomain itself replaces the parent's rules for that name.
Do I need a separate record for each CA?
Yes. Publish one issue record per certificate authority. Multiple records at the same name combine, so each listed CA is allowed.
What is the difference between issue and issuewild?
issue covers certificates in general. issuewild covers wildcard certificates, and when it is present it takes priority over issue for those requests. Without it, issue applies to wildcards as well.
What does issue ";" mean?
A semicolon with no CA domain authorises nobody, so no CA may issue for that name. It suits domains that should never hold a certificate.
Will adding CAA affect certificates I already have?
No. CAs check CAA when they issue, so existing certificates keep working. The effect comes at the next renewal, which is why a missing CA shows up later.
What does the CAA flag mean?
The flag is usually 0. A value of 128 sets the critical bit, which tells a CA that does not understand the tag that it must not issue.
My CA refused a certificate because of CAA. What should I do?
Look up the name here and see which set applies. Add an issue record with the domain your CA documents, on the name shown as the source, and retry once the change has reached public resolvers.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.