CAA Record Checker

CAA Record Checker

A CAA (Certification Authority Authorization) record is a DNS record that names which Certificate Authorities are allowed to issue TLS/SSL certificates for your domain. Every publicly-trusted CA is required to check it before issuing. This tool reads your published CAA records and explains what they permit.

How CAA works

CAA records are published in DNS as a triple: a flag, a tag, and a value. The tags that matter are:

• issue — names a CA permitted to issue standard certificates, e.g. issue "letsencrypt.org". If any issue records exist, only the named CAs may issue; everyone else is refused.
• issuewild — the same, but specifically for wildcard (*.domain) certificates.
• iodef — a contact (mailto: or URL) where a CA reports an attempted policy violation.

A special value of issue ";" means "no CA may issue at all" — useful for a parked domain that should never have a certificate.

Tree-climbing and inheritance

CAA is checked by climbing the DNS tree. If shop.example.com has no CAA record, the CA looks at example.com, then the parent, and uses the first record set it finds. So an absence at your exact hostname does not mean no policy applies — a record higher up the tree still governs issuance. This tool reports what is published at the name you enter.

Why it matters for security

Without CAA, any of the hundreds of publicly-trusted CAs can issue a certificate for your domain. A single compromised or tricked CA is then enough to mint a valid certificate an attacker can use to impersonate your site. CAA shrinks that attack surface to the one or two CAs you actually use — a mis-issuance from any other is refused at the source. It is one of the highest-value, lowest-effort DNS hardening steps available.

Worked example

example.com. CAA 0 issue "letsencrypt.org" plus 0 iodef "mailto:security@example.com" means only Let's Encrypt may issue, and any CA that receives a request from someone else is asked to email your security team. That single pair both limits issuance and gives you an early-warning tripwire for attempted fraud.

Common mistakes

• Assuming no CAA record is safer — it is the opposite; no record means every CA is allowed.
• Forgetting issuewild when you use wildcard certificates — an issue record alone does not necessarily cover them.
• Listing a CA by the wrong identifier — the value must match the CA's documented CAA domain exactly, or issuance breaks.