CAA Record Checker
Check the relevant CAA record set for a domain, including issue, issuewild and iodef properties.
The checker walks up the DNS name tree until it finds the relevant CAA record set.
Check a domain’s CAA certificate policy
CAA records let a domain publish certificate-authority authorization information in DNS. This checker walks up the DNS name tree until it finds the relevant CAA record set and then explains the entries it finds.
How to use it
- Enter a domain or hostname.
- Select Check CAA.
- Review the relevant DNS name, record count and certificate-authority rules.
Understanding issue and issuewild
The issue property applies to ordinary certificate issuance. The issuewild property can define a separate policy for wildcard certificates. The checker shows both so you can see whether wildcard and non-wildcard requests are treated differently.
What if no CAA record is found?
If there is no relevant CAA record set, CAA itself does not add an issuance restriction for that name. This is different from a configuration that deliberately uses empty authorization values to restrict issuance.
Use it during certificate troubleshooting
CAA is worth checking when an SSL/TLS certificate order is unexpectedly refused, when changing certificate authorities, or when auditing which authorities a domain intends to authorize.