CAA Record Lookup
Look up a domain's CAA records - which Certificate Authorities are authorized to issue SSL certificates for it.
Enter a domain to look up its CAA records - which Certificate Authorities are authorized to issue SSL certificates for it.
More DNS Tools
View all 12JustChecker tracks your DNS records continuously and alerts you the moment something changes.
What Is a CAA Record?
CAA (Certification Authority Authorization) records list which certificate authorities are allowed to issue SSL/TLS certificates for a domain, for example only letsencrypt.org. Certificate authorities must check them before issuing.
When to Use It
- When a certificate request fails with a CAA error.
- When switching to a new certificate provider.
- To harden a domain against certificates being issued by the wrong authority.
How to Use It
- Enter the domain.
- Check that your certificate authority appears in an
issueorissuewildentry.
Understanding the Result
No CAA records means any trusted authority may issue certificates - this is the default and is fine. If records exist, only the listed authorities may issue. iodef gives an address for reports about rejected requests.
Limitations
CAA only controls issuance of new certificates; it does not affect ones that already exist. Check the certificate actually in use with the SSL Certificate Checker.
Frequently Asked Questions
Explore More Tools
Keep going with related categories and our most used tools.