CAA Record Lookup
CAA records tell CAs who is allowed to issue for your domain. This shows what yours currently say.
What this tool does
Looks up the CAA records for a domain. A CAA record is a DNS entry naming which Certificate Authorities are permitted to issue certificates for that name — and CAs are required by the CA/Browser Forum baseline requirements to honour it.
If the exact name carries no CAA set, the lookup walks up the parent domains exactly as a CA does, so a record on example.com is correctly reported as governing shop.example.com.
How to use it
Enter a domain and press Look up. The query is performed by this server against its DNS resolver.
Reading the result
- issue — CAs allowed to sign ordinary certificates.
- issuewild — CAs allowed to sign wildcards. If absent, the
issuelist governs wildcards too. - iodef — where a CA should report an attempted violation.
- NO CAA — no record anywhere up the tree, so any public CA may issue for this domain.
- ISSUANCE BLOCKED — an empty value (
;) tells every CA to refuse.
Common problems
- Issuance fails with a CAA error. Your CA is not on the list. Add it, wait for the DNS TTL to expire, and retry.
- A wildcard order is refused while normal ones succeed. You have an
issuewildrecord that omits the CA. - No CAA at all. Not an error, but publishing one is a cheap way to prevent mis-issuance.