CAA Record Checker

About the caa record checker

A CAA (Certification Authority Authorization) record is its own DNS record type — type 257, not a TXT record — and it names which certificate authorities are permitted to issue TLS certificates for a domain. Each one carries a flags byte, a property tag such as `issue` or `issuewild`, and a value. Every publicly trusted CA is required to check for a CAA record before issuing, and to refuse issuance if the record exists and does not list them, which makes CAA a real preventative control rather than just documentation.

This tool reads the CAA records published for a domain, including any it inherits from a parent zone if the domain itself has none, and lists the authorized issuers along with any restrictions such as a specific account or validation method. It also flags common mistakes, like listing an issuer's parent domain instead of the exact hostname a CA checks against.

The two properties that matter most are issue, which authorizes certificates for the exact hostname, and issuewild, which separately authorizes wildcard certificates; a domain can permit one without the other. An iodef property can also be set to an address that CAs should notify when they see an issuance request that violates the policy. Adding a CAA record is safe as long as it lists every CA you actually use, including any CA your CDN or hosting provider relies on for automatic certificate issuance, since omitting one will cause future renewals through that provider to fail.

Common questions

What does a CAA record do?

It restricts which certificate authorities may issue TLS certificates for the domain. Every publicly trusted CA is required to check it before issuing and must refuse if the record excludes them.

Will CAA break my renewals?

Only if you omit a CA you actually use. The tool detects your current issuer from the live certificate and suggests a matching record so renewals keep working.

What is the iodef tag?

An address, usually a mailto: or https: URL, where CAs report an issuance request that violated your CAA policy.

Do subdomains inherit a CAA record?

Yes. A certificate authority checking a name with no CAA record of its own walks up the tree until it finds one, so a record at the apex constrains every subdomain that does not publish its own.

What does the flags byte do?

A value of 128 marks the property as critical, which means a CA that does not understand the tag must refuse to issue rather than ignore it. A critical flag on a tag nobody recognises blocks issuance entirely, so it is worth checking rather than copying.

Does CAA apply to wildcard certificates too?

Only if the issuewild property is also set. A domain can authorize a CA for regular certificates without authorizing it for wildcards, and vice versa.