Free CAA lookup
CAA Record Lookup
Free, no sign-up. We only fetch the public URL you enter.
Short answer
Enter a domain such as example.com above and the CAA lookup queries DNS for its CAA records. Each line shows the flag, the tag – issue, issuewild or iodef – the value (usually a CA domain like letsencrypt.org) and the TTL. If no CAA record is found, there is no restriction and any public CA may issue under its normal policy. If records exist but do not name the CA you use, issuance and renewals are refused. monitordefend’s free SSL checker complements this by showing the certificate a site currently serves.
- Free, no sign-up: all CAA records of a domain with flag, tag, value and TTL.
- issue = normal certificates, issuewild = wildcards, iodef = violation reports.
- No CAA record means no restriction – any CA may issue.
myshop.com. 3600 IN CAA 0 issue "letsencrypt.org" myshop.com. 3600 IN CAA 0 issue "sectigo.com" myshop.com. 3600 IN CAA 0 issuewild ";" myshop.com. 3600 IN CAA 0 iodef "mailto:security@myshop.com"
This free CAA lookup shows which certificate authorities are allowed to issue SSL/TLS certificates for a domain. CAA records are a small DNS-based control with a big effect: set correctly, they stop unauthorised certificate issuance; set wrongly, they block your own renewals. The lookup lists every CAA record of a hostname with its TTL, so you can confirm the rules before a certificate request – or understand why one just failed.
How does the CAA lookup work?
You enter a domain and run the check. The tool sends a DNS query of type CAA for that name and prints each record it receives, broken into the numeric flag, the tag and the value, plus the TTL. One name is queried at a time – if you want to know the policy for a subdomain that has no CAA records of its own, also look up its parent, because that is where a certificate authority would look next.
The output mirrors what a CA sees at the moment of issuance, minus any caching the CA’s resolvers may still hold. That makes it the quickest way to check a policy right before you request or renew a certificate.
What is a CAA record?
A CAA record – Certification Authority Authorization – lets a domain owner state in DNS which certificate authorities may issue SSL/TLS certificates for the domain. Since 2017 every publicly trusted CA is required to check CAA before issuing. If records exist and the CA is not named, it must refuse the request.
- Request Certificate for www.myshop.com
- CA checks CAA Looks up www, then myshop.com
- Authorised? Is the CA named in an issue tag?
- Issue or refuse Certificate – or CAA error
This closes a gap in the certificate system: any of the many trusted CAs could technically issue a certificate for any domain if someone passes its validation, for example through a compromised server or a mistake in the validation process. CAA reduces the set of CAs that can be tricked to the ones you actually use. It does not replace secure DNS or account security, but it is free and takes minutes to set up.
When should you check a CAA record?
CAA records rarely change, which is exactly why they get forgotten. A policy written years ago for one CA can quietly block the next one.
- Before issuing or renewing an SSL/TLS certificate, especially with a new CA.
- When switching certificate providers or adding a CDN that issues certificates on your behalf.
- If certificate issuance fails unexpectedly with a CAA-related error.
- After DNS changes or a nameserver migration, to confirm the records came along.
- During a security review, to make sure only the CAs you use are authorised.
Common CAA values: issue, issuewild and iodef
A CAA record has three parts: a flag (almost always 0), a tag and a value. The tag decides what the record controls. Many DNS panels hide the flag and let you pick the tag from a list.
-
myshop.com · CAA issue "letsencrypt.org"Policy for the whole tree -
www.myshop.com · no CAAInherits from myshop.com -
shop.myshop.com · no CAAInherits from myshop.com -
pay.myshop.com · CAA issue "digicert.com"Own policy – overrides the parent
| Tag | Meaning | Example value |
|---|---|---|
| issue | This CA may issue standard (non-wildcard) certificates | "letsencrypt.org" |
| issuewild | This CA may issue wildcard certificates; overrides issue for wildcards | "digicert.com" or ";" to forbid |
| iodef | Where a CA may report requests that violate your policy | "mailto:security@example.com" |
How to read the result
Read the issue records as an allow-list: each one names a CA domain that may issue normal certificates. Several issue records simply add CAs to that list. An issue value of ";" means no CA at all may issue normal certificates – useful for domains that never serve HTTPS, disastrous for one that does.
If issuewild records exist, they alone decide who may issue wildcard certificates; if they do not, wildcards follow the issue list. An iodef record does not grant or forbid anything – it just tells CAs where to send reports. A flag of 128 marks a record as critical, meaning a CA that does not understand its tag must refuse to issue; you will rarely need it.
CAA records and subdomains
CAA policies are inherited. When a CA checks www.example.com and finds no CAA records there, it climbs to example.com and applies whatever it finds. As soon as a subdomain has CAA records of its own, those replace the parent policy entirely for that name and the names below it.
This makes it easy to set one policy at the root for everything, and to carve out exceptions – for example a payment subdomain that uses a different CA. It also means that adding a single CAA record to a subdomain can unexpectedly lock out the CA that was fine under the parent rule. Note that if a name is a CNAME, CAs follow the alias and may evaluate the target’s CAA records, which matters for subdomains handed to SaaS platforms.
Why certificate issuance fails because of CAA
The usual reason is simple: your CAA records do not authorise the CA you are using. That happens after switching from one CA to another, when a hosting panel or CDN starts issuing through a provider you never listed, or when a wildcard is requested but only issue records exist for a different CA.
The second reason is DNS trouble. If the CA cannot get a clear answer – the nameserver times out or returns an error rather than “no records” – it must treat that as a failure and refuse. A lookup that returns a normal answer, even an empty one, shows that this side is fine. Typos in the CA domain are the third classic: the value must match the identifier the CA documents exactly.
Where do I add or update a CAA record?
In the DNS provider that hosts your authoritative zone – the one your active nameservers point to, which is not always your domain registrar. Create a record of type CAA on the root domain (or the subdomain you want to control), choose the tag, enter the CA domain and save.
To allow Let’s Encrypt, the standard format is CAA 0 issue "letsencrypt.org". To allow several CAs, add one issue record per CA. Check your CA’s documentation for its exact identifier, include every service that issues certificates for you – CDNs and managed hosting often use their own CA partners – and then run the lookup to confirm the records are live.
CAA and monitordefend
monitordefend does not watch CAA records or warn about certificate expiry. Its free SSL checker shows the certificate a site currently serves, and its uptime check every five minutes emails you if the site stops answering.
Frequently asked questions
Does a CAA record affect certificates that already exist?
No. Certificate authorities check CAA only at the moment they issue or renew a certificate. A certificate that is already installed stays valid until it expires, even if a later CAA change would no longer allow its issuer. The effect shows up at the next renewal, which is why a CAA change should be tested before the current certificate runs out.
What does the critical flag 128 in a CAA record mean?
A flag of 128 marks a property as critical: a CA that does not understand that tag must refuse to issue. For the standard tags issue, issuewild and iodef the flag is normally 0, and setting 128 without a reason can block issuance unexpectedly.
What is a CAA record?
A CAA record specifies which certificate authorities may issue SSL/TLS certificates for your domain. Publicly trusted CAs are required to check it before every issuance.
What does it mean if no CAA record is found?
That no restriction is set. Any public CA may issue certificates for the domain as long as its usual validation succeeds.
What do issue, issuewild and iodef mean in CAA?
issue names a CA that may issue standard certificates, issuewild names a CA that may issue wildcard certificates, and iodef gives an email address or URL for reports about policy violations.
Why is my certificate issuance failing because of CAA?
Most often your CAA records do not authorise the CA you are using. DNS errors while the CA checks CAA also block issuance until they are fixed.
Do CAA records apply to subdomains?
Yes, by inheritance: a subdomain without CAA records uses the policy of the nearest parent. A subdomain with its own CAA records follows only those.
Where do I add or update a CAA record?
At the DNS provider hosting your authoritative zone – the provider your active nameservers belong to.
How do I allow Let’s Encrypt or multiple CAs with CAA?
Add one issue record per CA, for example CAA 0 issue "letsencrypt.org" and a second record for another CA. Your DNS interface may hide the numeric flag.
Related pages
Monitor your site’s availability
Start for free and set up your first check in minutes.
Start for free