CAA Record Checker

How this works

1. 1

   Query the hostname

   CAA records are fetched for the exact name you entered over DNS-over-HTTPS.

2. 2

   Climb to the parent

   If none exist, each parent label is checked in turn, exactly as RFC 8659 requires certificate authorities to do.

3. 3

   Decode and review

   Flags, tags and CA identifiers are parsed, mapped to CA names and checked for the common mistakes.

Frequently asked questions

What is a CAA record?

Certification Authority Authorization is a DNS record (RFC 8659) that lists which certificate authorities may issue SSL/TLS certificates for a domain. Every public CA must check it before issuing. It prevents an attacker who tricks some other CA from getting a certificate in your name.

Do I need a CAA record?

It is optional but recommended. Without one, any CA can issue for your domain. With one, only the CAs you name can. Most sites need just one 'issue' line, for example letsencrypt.org, pki.goog for Google Trust Services (used by Cloudflare and Google), or digicert.com.

My certificate renewal failed with a CAA error. Why?

The CAA set does not include the CA trying to renew, or a wildcard request hit an 'issuewild' restriction. Check which CA your host or Cloudflare uses now; providers change CAs without notice, so a CAA added for Let's Encrypt can break a switch to Google Trust Services.

What do issue, issuewild and iodef mean?

'issue' authorises a CA for normal certificates; 'issuewild' does the same for wildcard (*.domain) certificates and overrides 'issue' for them; 'iodef' gives an email or URL where CAs report requests they refused. A value of just a semicolon means no CA at all.

Does CAA on my bare domain cover subdomains?

Yes. CAs check the hostname, then its parent, then the next parent, stopping at the first CAA set they find. So a record on example.com applies to shop.example.com unless shop.example.com publishes its own CAA, which then takes precedence.