CAA Record Check

CAA (Certification Authority Authorization) Lookup checks, in real time, which certificate authorities (CAs) a domain allows to issue certificates. Enter a domain and the tool reads the CAA rules published in public DNS (issue, issuewild, iodef) and shows the allowed CAs and flags in a table.

CAA is a last line of defense against mis-issuance. With no record, any CA may issue; with a record, only the listed CAs may. It is also the first thing to check when certificate issuance is suddenly refused. Results are briefly cached for fast responses.

How CAA works

Before issuing a certificate, CAs are required to look up the CAA records of the target domain (and its parents). If the CA is not on the allow list, it must refuse to issue. In effect, CAA is a single DNS line that declares "only these CAs may issue certificates for this domain."

• issue: the CAs allowed to issue regular (non-wildcard) certificates
• issuewild: CAs allowed specifically for wildcard (*.example.com) certificates
• iodef: a contact (mailto: or URL) the CA uses to report policy violations
• flag: 128 means critical — a CA that cannot understand it must refuse issuance

A Let's Encrypt example

To allow only Let's Encrypt to issue, configure the records below. Setting a value of just a semicolon, like issue ";", means no CA at all may issue.

• example.com. CAA 0 issue "letsencrypt.org"
• example.com. CAA 0 issuewild "letsencrypt.org"
• example.com. CAA 0 iodef "mailto:security@example.com"

Things to watch when configuring

CAA follows the nearest record above it (if a subdomain has none, resolution walks up to the parent). When switching CAs or relying on automated renewal, a missing CA in the list causes issuance to fail silently. In multi-CA setups, list every CA you use on the issue lines. To see which CA actually issued the live certificate use the SSL Certificate Checker, and to view other DNS records on the same domain use the DNS Lookup.

CAA tags at a glance

A CAA record has the form <flag> <tag> "<value>". In practice there are only three tags you will use; their purpose and an example for each are shown below.

Reading a real example

Suppose you look up a domain and the only line returned is 0 issue "letsencrypt.org". That result means only Let's Encrypt may issue certificates for this domain. If another CA such as DigiCert or Sectigo tries to issue, it sees it is not on the allow list and refuses.

• Symptom: a new certificate request through DigiCert is rejected
• Cause: the CAA lists only letsencrypt.org and is missing digicert.com
• Fix: add a second line 0 issue "digicert.com" so both CAs are allowed

Conversely, if the lookup comes back empty(no CAA record), there is no restriction at all, so any CA may issue. In other words, "no result" is not an error — it is the normal unrestricted state.