DNS
CAA record checker
Read which certificate authorities a domain allows, and see whether the one you actually use is among them.
Free, no accountLive check
Result
Fill in the form and press Check the CAA record. The verdict and the detail appear here.
What this is
This caa record checker reads the CAA record a name actually publishes - or the ancestor it is inherited from - and tells you plainly whether the certificate authority you rely on is allowed to issue for it at all.
A CAA record is the one place in DNS a domain gets to name which certificate authorities are trusted to issue for it, as RFC 8659 defines it: an issue tag lists a CA by its own domain, issuewild does the same for wildcard certificates, and iodef names where a CA should report a request it had to turn down. A name with none of these published has made no such choice at all.
A CAA set is not always sitting at the exact name you queried. RFC 8659 §3 has a CA climb from the name being issued for up to the nearest ancestor that actually publishes one, so a restriction set once at a company's apex domain reaches every subdomain underneath it without being repeated.
For what a domain with no CAA record at all actually permits, and where CAA sits among the other records a domain needs, see our blog guide "The DNS records a domain needs, and what each one actually does."
How to read the result
Two situations look similar from the outside but mean opposite things, and this page tells them apart rather than folding them into one warning. A domain with no CAA record at all has made no restriction: any publicly trusted CA may issue for it, which is the default the whole web runs on, not a mistake. A domain that does publish a CAA record but leaves out the CA you actually use has made a restriction that is simply too narrow for how the domain is really run - and a request to that CA will come back refused, not slow.
The table below lists every tag found, in plain words, at the name the record was actually read from - which may be a parent of the one you typed. A fail above it names the exact CA that was left out and hands you the one line to add; everything else is a lower-severity note about how the existing record is shaped.
Common mistakes
What goes wrong most often, and how to tell.
- Assuming no CAA record means something is brokenAn empty CAA lookup is not a fault. It means no restriction was ever set, and every publicly trusted CA remains free to issue - exactly the situation most domains have been in since before CAA existed at all.
- Checking the subdomain and missing the record set on its parentA CAA record set once at a company's root domain governs every subdomain beneath it unless one of them publishes its own. Querying only the subdomain and finding nothing there does not mean issuance is unrestricted.
- Switching certificate authorities without updating the issue listA CAA record naming only the old CA keeps authorizing it long after a migration, while the new CA - and any CDN that renews on your behalf through a different one - gets refused the moment it tries.
Questions
What people ask about this tool.
- Nothing is restricted. Any publicly trusted certificate authority remains free to issue a certificate for that name, which is the default every domain starts in - CAA is something a domain opts into, not something it has to actively avoid breaking.
- Because RFC 8659 §3 has a certificate authority climb from the name it is issuing for up to the nearest ancestor that actually publishes a CAA record, so a restriction set once at the root domain applies to every subdomain beneath it automatically.
- Refused outright, not delayed. A compliant certificate authority checks the issue tags before it issues anything at all, and a domain it is not named in gets no certificate from it regardless of how long it waits or how many times it retries.
- RFC 8659 §4.5 says a certificate authority that does not recognise a tag carrying the critical flag must refuse to issue rather than ignore that one tag and proceed - so an unfamiliar critical tag can block every certificate for a name, not just the property it names.
Sources
Every fixed value here comes from the provider’s own documentation. These pages change, so each says the day it was last read.
- IETF, “RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record” read 13 October 2026
- Let's Encrypt, “Certificate Authority Authorization (CAA)” read 13 October 2026
Use it from the API
The same check, as one request.
This example uses a name RFC 2606 reserves for documentation, ending in .example, .test, .invalid or .localhost. None of them is a real domain, and nobody can register one.