Lookups
CAA Record Checker
See whether a domain restricts which Certificate Authorities are allowed to issue SSL certificates for it.
| Tag | Authorized For | Flags |
|---|
No records isn't an error, it just means anyone can issue certs. `issue` restricts normal certs, `issuewild` restricts wildcards, `iodef` is a violation contact.
Related: check its SPF and DMARC records, another DNS-based security check.
This lookup is sent via DNS-over-HTTPS to Cloudflare, with Google and NextDNS as fallbacks.
Learn about CAA records
What a CAA record actually restricts
A CAA (Certification Authority Authorization) record lets a domain owner declare which Certificate Authorities are allowed to issue TLS/SSL certificates for it. Every publicly trusted CA is required to check for a CAA record before issuing a certificate, and to refuse if the requesting CA isn't on the list. It's a control on certificate issuance, not on anything else about the domain.
Reading your results
No CAA record at all means the default, permissive state: any publicly trusted CA can issue a certificate for the domain. Where records are present, they can carry different tags. issue permits standard certificates from that CA, issuewild specifically permits wildcard certificates, and iodef names a contact to be notified of unauthorized issuance attempts.
Common questions
Do I need a CAA record? It's optional, but a reasonable defense-in-depth step, especially if you deliberately use only one CA (for example, restricting issuance to Let's Encrypt) and want to make mis-issuance from another CA harder.
My certificate request just failed. Could CAA be why? Yes, this is a common cause. Either the CAA record doesn't list the CA you're actually requesting from, or a CAA record set on a parent domain is restricting the subdomain, since CAA is inherited down the domain tree unless a subdomain sets its own.
Does CAA have anything to do with SPF or DMARC? No, they're unrelated systems. CAA governs who can issue TLS certificates for the domain, while SPF and DMARC govern who's allowed to send email as the domain.