Free CAA Record Lookup & Checker

Quick select:
Your IP:
Check the DNS record Propagation in Multi-Region Check Multi-Region
Domain Type Primary NS Responsible Person Serial Refresh Retry Expire Minimum TTL
Name Server IP Address TTL
Domain Type TTL Record Value
Trace Result
Domain Type Record Status
Domain Type Record Status
Rate this result

Check live CAA DNS records, TTL values, and trace the full root-to-authoritative resolution path.

CAA (Certification Authority Authorization) Overview

What is a CAA record?

A CAA record specifies which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for your domain.

Why do you need a CAA record?

CAA records reduce the risk of unauthorized or mistaken certificate issuance, strengthening the security of your domain’s HTTPS.

CAA record structure

A CAA record includes the domain, TTL, record type (CAA), a flag, a tag, and a value. Example: example.com. 3600 IN CAA 0 issue "letsencrypt.org"

How to create a CAA record?

Log in to your DNS provider's console and add a CAA record with a flag (usually 0), a tag (issue, issuewild, or iodef), and the value (the CA's domain, or a mailto address for iodef).

FAQs

issue authorizes a CA to issue certificates; issuewild authorizes wildcard certificates; iodef provides a contact (e.g. a mailto address) for the CA to report policy violations.

If no CAA record exists, any CA may issue certificates for your domain. Adding CAA restricts issuance to the CAs you list.

No. CAA is checked only at issuance time. Existing certificates remain valid; CAA governs new issuance going forward.

Yes. Add one issue record per CA you want to allow. A request is permitted if it matches any of the listed CAs.

At the domain (or subdomain) you want to protect. CAs also check parent domains, so a CAA at the apex covers subdomains unless a subdomain overrides it.

CAA Record Troubleshooting & Common Fixes

SSL certificate renewal fails: “CAA record prevents issuance”

Certificate Authorities (CAs) are legally required by CA/Browser Forum rules to check CAA records before issuing an SSL/TLS certificate. If your domain has a CAA record that permits DigiCert or Sectigo, but your hosting server attempts to auto-renew a free certificate via Let's Encrypt or cPanel AutoSSL, issuance is immediately blocked.

How to fix: You can permit multiple authorities by adding separate CAA records. For Let's Encrypt, add a CAA record with flag 0, tag issue, and value "letsencrypt.org". For Sectigo, add "sectigo.com".

Wildcard SSL certificate (*.yourdomain.com) fails to issue

If you specify the issuewild tag in any CAA record, CAs must ignore standard issue tags when validating wildcard certificates. If you only have issue "letsencrypt.org" and an issuewild ";" (which blocks all wildcards), wildcard requests will fail.

How to fix: To explicitly permit wildcard issuance, add a CAA record with tag issuewild set to your desired CA, for example: 0 issuewild "letsencrypt.org".

Subdomain SSL blocked due to parent apex CAA inheritance

CAs check up the DNS tree. If you request a certificate for app.sub.example.com, the CA checks that subdomain, then sub.example.com, and finally the root apex example.com. An apex CAA record applies to all subdomains unless explicitly overridden.

How to fix: If a third-party platform manages SSL for a specific subdomain, you can publish a dedicated CAA record directly on that subdomain (e.g. app.sub.example.com) to override the apex policy without relaxing your main domain's security.

DNS Info extension for Chrome is now available

Install

Install