CAA Record Lookup
Look up a domain's CAA records to see which certificate authorities are allowed to issue TLS certificates for it - a key control against mis-issuance.
About CAA Record Lookup
A CAA (Certification Authority Authorization) record tells certificate authorities whether they are permitted to issue certificates for your domain. The CAA Record Lookup queries these records and shows you, in plain terms, which CAs are authorised - or warns you when there is no CAA record at all, which means any CA in the world may issue for the domain.
CAA is a small but powerful safeguard defined in RFC 8659. Before issuing a certificate, a compliant CA must check the domain's CAA records and refuse if it is not listed. Publishing a CAA record therefore limits your exposure to certificate mis-issuance, whether from a compromised CA or a mistaken request, by pinning issuance to the authorities you actually use (for example Let's Encrypt, DigiCert or Sectigo).
The tool reports each record's tag (issue, issuewild or iodef), its value and flags. It queries through our sovereign European resolver, so results reflect what CAs see when they validate a request.
How to use it
- 1Enter the domain name to check.
- 2Select Look up CAA.
- 3If records exist, read the list of authorised issuers.
- 4If the tool warns that any CA may issue, consider adding a CAA record for the authorities you use.
- 5Include an issuewild entry if you use wildcard certificates.
Common use cases
- -Confirming only your chosen CA can issue certificates for a domain.
- -Auditing domains for missing CAA records as a security baseline.
- -Troubleshooting a certificate request that a CA refused due to CAA.
- -Documenting certificate-issuance policy across a portfolio of domains.
- -Checking a domain before trusting certificates issued for it.
Frequently asked questions
- What does it mean if a domain has no CAA record?
- With no CAA record, any publicly trusted certificate authority is allowed to issue certificates for the domain. Adding a CAA record restricts issuance to the CAs you name, reducing the risk of mis-issuance.
- What is the difference between the issue and issuewild tags?
- The issue tag authorises a CA to issue normal certificates for the domain; issuewild specifically authorises wildcard certificates. If you use wildcards, add an issuewild entry as well.
- Does a CAA record improve my HTTPS security directly?
- Indirectly. It does not change how a certificate is validated by browsers, but it prevents unauthorised CAs from issuing certificates for your domain in the first place, closing off a whole avenue of attack.
- Do all certificate authorities honour CAA?
- All publicly trusted CAs are required by the CA/Browser Forum to check CAA before issuance. Publishing a record is therefore enforced across the trusted ecosystem.
- How do I add a CAA record?
- Add a CAA record at your DNS provider, for example: 0 issue "letsencrypt.org". Re-run this lookup afterwards to confirm it is published correctly.