🛡️ CAA Record Checker
Check which Certificate Authorities are authorized to issue SSL certificates for a domain
📚 CAA lookup: what the records mean
CAA (Certificate Authority Authorization) records allow domain owners to specify which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for their domain.
CAA Record Tags
| Tag | Purpose | Example |
|---|---|---|
issue |
Authorize CA for regular certificates | 0 issue "letsencrypt.org" |
issuewild |
Authorize CA for wildcard certificates | 0 issuewild "digicert.com" |
iodef |
Report policy violations | 0 iodef "mailto:security@example.com" |
CAA record check: example records for common CAs
Most people who run a CAA lookup want to write one next. Use the CA's identifier exactly as shown, one issue record per CA you use:
| Certificate Authority | CAA record |
|---|---|
| Let's Encrypt | 0 issue "letsencrypt.org" |
| DigiCert (incl. GeoTrust, Thawte, RapidSSL) | 0 issue "digicert.com" |
| Sectigo (formerly Comodo; also issues ZeroSSL) | 0 issue "sectigo.com" |
| GlobalSign | 0 issue "globalsign.com" |
| Google Trust Services | 0 issue "pki.goog" |
| Amazon (AWS Certificate Manager) | 0 issue "amazon.com" — Amazon also honours amazontrust.com, awstrust.com and amazonaws.com |
| GoDaddy | 0 issue "godaddy.com" |
| Entrust | 0 issue "entrust.net" |
| SSL.com | 0 issue "ssl.com" |
| Cloudflare Universal SSL | Cloudflare issues through several CAs — allow letsencrypt.org, pki.goog, sectigo.com and ssl.com, or let Cloudflare manage CAA for you |
| Wildcard certificates | 0 issuewild "letsencrypt.org", or 0 issuewild ";" to forbid wildcards entirely |
| Violation reports | 0 iodef "mailto:security@example.com" |
Re-run the CAA test above after publishing; the record is inherited by every subdomain that doesn't set its own.
Why CAA Records Matter
Since 2017, the CA/Browser Forum has required every Certificate Authority to check CAA records before issuing a certificate. If your domain publishes a CAA record, a CA that isn't on your list must refuse to issue — even to an attacker who has somehow proven control of the domain. That makes CAA a cheap, powerful guardrail against mis-issuance: a rogue or tricked CA can't quietly mint a certificate for your domain.
- Limit your attack surface — only the CAs you actually use can issue certificates.
- Get alerted — add an
iodeftag and CAs will report blocked issuance attempts to you. - Zero downside — CAA doesn't affect existing certificates or visitors; it only constrains future issuance.
Pair a CAA policy with a valid certificate — check yours with the SSL checker.
How to Add a CAA Record
- Log in to your DNS provider and add a new CAA record on the root domain.
- Set the tag to
issueand the value to your CA's identifier, e.g.0 issue "letsencrypt.org". Add one per CA you use. - Add an
issuewildrecord if you use wildcard certificates, or set0 issuewild ";"to forbid them. - Optionally add
0 iodef "mailto:security@yourdomain.com"to receive violation reports. - Save and re-check here. CAA is inherited by subdomains, so a root-level policy usually covers everything.
Not sure how DNS records propagate after a change? See the DNS records guide.
Frequently Asked Questions
What is a CAA record?
A CAA (Certification Authority Authorization) record is a DNS record that lists which Certificate Authorities are allowed to issue SSL/TLS certificates for your domain. CAs are required to honor it before issuing.
What is Certificate Authority Authorization?
It's the standard (RFC 8659) behind CAA records: a way for a domain owner to declare, in DNS, exactly which CAs may issue certificates for the domain — so no other CA can, even under attack.
Do I need a CAA record?
It's not required for HTTPS to work, but it's a recommended security best practice. If you know which CA(s) you use, a CAA record closes off issuance by any other CA at almost no cost.
What happens if a domain has no CAA record?
Any Certificate Authority is allowed to issue certificates for it. That's the default — CAA simply restricts it. No CAA record isn't an error, just a missed hardening opportunity.
How do I add a CAA record?
Create a CAA record at your DNS provider with the issue tag set to your CA (for example 0 issue "letsencrypt.org"), add issuewild for wildcard certificates, and optionally iodef for reports. Then re-check it with this tool.
How do I test a CAA record?
Enter the domain above. The CAA test queries DNS for the record, walks up to the parent domain if the name itself has none (that's how CAA inheritance works), and lists every issue, issuewild and iodef entry with a plain-English verdict on which CAs may issue.
What does issuewild do?
issuewild controls wildcard certificates (*.example.com) separately from ordinary ones. If you publish only issue records, they apply to wildcards too; add 0 issuewild ";" to forbid wildcard issuance while still allowing normal certificates from your CA.
What is the iodef tag for?
iodef names a mailto: or https: address where a CA can report a certificate request it refused because of your CAA policy. It's optional, but it's the only way to learn that someone tried to get a certificate for your domain from a CA you didn't authorise.