How to use CAA Record Lookup
The CAA Lookup retrieves the Certification Authority Authorization records published in a domain’s DNS, which declare exactly which certificate authorities are permitted to issue certificates for that domain. CAA records are a powerful safeguard against mis-issuance: a compliant CA must refuse to issue a certificate if the domain’s CAA records do not authorise it, closing off a whole class of attacks where a rogue or tricked CA issues a certificate for a domain it should not. Use this tool to confirm your CAA policy is in place or to debug why a CA is refusing to issue.
- Enter the domain whose CAA policy you want to inspect.
- Click Lookup to fetch its CAA records from DNS.
- Read the issue and issuewild tags listing authorised CAs.
- Confirm the CA you intend to use is included.
- Check the iodef tag for the contact alerted on violations.
What CAA records contain
A CAA record pairs a tag with a value. The issue tag names a CA allowed to issue standard certificates; issuewild names a CA allowed to issue wildcard certificates; and iodef gives a URL or mailbox where a CA can report an attempted violation. A domain can list several CAs, and an empty issue value of ";" blocks all issuance. Because CAA is checked at issuance time, a record that omits your chosen CA will cause certificate requests to fail — exactly the symptom this lookup helps you diagnose.
| Tag | Meaning |
|---|---|
| issue | CA allowed to issue standard certificates |
| issuewild | CA allowed to issue wildcard certificates |
| iodef | Where to report a policy violation |
Using CAA without locking yourself out
CAA is opt-in: a domain with no CAA records lets any public CA issue, which is the historic default. Adding records tightens that, but you must include every CA you actually use — including any behind a CDN or a managed certificate service, which often issue on your behalf. Forgetting one is the classic mistake that breaks automated renewals. Inheritance also matters: CAA checks walk up from the exact name to the parent domain, so a record at the apex protects subdomains unless overridden. Review your records whenever you change certificate providers.
Glossary
- CAA record
- A DNS record declaring which CAs may issue certificates for a domain.
- issue tag
- A CAA tag authorising a CA to issue standard certificates.
- issuewild tag
- A CAA tag authorising a CA to issue wildcard certificates.
- iodef
- A CAA tag giving a contact for reporting issuance violations.
- Mis-issuance
- When a CA issues a certificate it should not have, which CAA helps prevent.
Related reading
Frequently Asked Questions
Why use CAA Record Lookup?
- See exactly which certificate authorities are permitted to issue for a domain
- Debug why a CA is refusing to issue a certificate by checking the authorisation list
- Confirm the iodef tag is set so violations are reported to the right contact
- Verify wildcard issuance is gated to the intended CA via the issuewild tag
Common use cases
- Diagnose why an automated certificate renewal fails with a CAA policy error
- Confirm a new CDN or managed certificate provider is listed before switching to it
- Check that a CAA record restricts issuance to a single CA after a security change
- Verify the iodef contact is correct before submitting a mis-issuance report
- Audit a domain's CAA records to confirm an old CA was removed after migration
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Network & DNS
SSL Certificate Checker
Check SSL/TLS certificate validity, issuer, expiry date, and remaining days for any domain to prevent HTTPS outages and certificate trust errors.
DNS Lookup Tool
Look up DNS records for any domain — A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA records. Free, instant results pulled from authoritative nameservers.
TXT Record Lookup
Look up TXT records for any domain. View SPF, DMARC, DKIM, and domain-verification TXT records instantly to debug email and ownership setup.
DNSSEC Checker
Check whether a domain has DNSSEC enabled by validating DNSKEY and DS records. Confirm DNS integrity signals and reduce spoofing risk.
SOA Record Lookup
Look up the SOA (Start of Authority) DNS record for any domain. Inspect nameserver, hostmaster email, serial version, and zone timing values.
DNS Propagation Checker
Check if your DNS changes have propagated worldwide. Test A, MX, and NS records across 8 global DNS servers to confirm updates are live everywhere.
Explore all Network & DNS.