Free CAA Record Checker
See which certificate authorities a domain allows to issue its certificates, looked up the way a CA looks, up the domain tree. When none is set, get the record to publish.
Three tags that decide who can get a certificate in your name
Every public certificate authority checks CAA before it issues. The record is one line of DNS, and without it any CA in the world may issue for your domain.
Issuance
The issue tagNames the certificate authorities allowed to issue for the domain. A CA that is not named must refuse the request. No record at any level means every CA may issue.
Wildcards
The issuewild tagA separate rule for wildcard certificates, which cover every name under the domain. When no issuewild record exists, the issue records apply to wildcards as well.
Reporting
The iodef tagWhere a CA reports a request it refused because of your record. Without it, someone asking a CA for a certificate in your name goes unnoticed.
Know when a CAA record disappears.
FortWatch checks the CAA records of every domain you own, hour by hour, and alerts you when a record is removed, a certificate authority you did not allow appears, or a domain never had one.
- A finding for every domain without a CAA record, with the record to publish
- An alert when a CA is added or a record is removed
- CAA, DNSSEC, SPF and DMARC watched together on every domain
Common questions about CAA records
What is a CAA record?
▾
CAA (Certification Authority Authorization) is a DNS record that names the certificate authorities allowed to issue certificates for your domain. Every public CA must check it before issuing, since 2017. A CA that is not listed refuses the request, so a mistaken or compromised CA cannot hand out a valid certificate in your name.
What do issue, issuewild and iodef mean?
▾
issue names a CA allowed to issue ordinary certificates. issuewild names a CA allowed to issue wildcard certificates; when it is absent, the issue records apply to wildcards too. iodef is a mailto or https address where a CA reports a request it refused because of your record. The number in front is the flags field, 0 in almost every record.
Why does the checker look at parent domains?
▾
A CA looks for CAA records on the exact name first, then on each parent up to the registrable domain, and uses the first set it finds. So one record on example.com covers app.example.com and every other name below it, unless a name below publishes records of its own. The checker climbs the same way and tells you at which level it found the records.
My domain has no CAA record. Is that a problem?
▾
Without CAA, any of the hundreds of public certificate authorities may issue a certificate for your domain. Most of the time nobody does, but when a CA is tricked or breached, your domain is among the ones it can be used against. One record naming the CA you use closes that door at no cost; FortWatch's DNS scanner raises a finding for every domain that lacks it.
What record should I publish?
▾
One issue record per certificate authority you use, on the registrable domain. Let's Encrypt is letsencrypt.org, Google Trust Services is pki.goog, DigiCert is digicert.com, Sectigo is sectigo.com, Amazon is amazon.com. Add an iodef record with an address you read. A value of ";" instead of a CA name means no CA may issue at all.
How does this CAA checker work, and is it free?
▾
It queries the CAA records of the domain you enter, and of its parents, through Cloudflare's public DNS over HTTPS, straight from your browser. Nothing is sent to our servers and nothing is logged. It is free, with no signup and no limit on checks.
Try another tool
DMARC & SPF Checker
Check any domain's SPF, DMARC, and DKIM records. Catch what spoofers can exploit.
SPF Record Checker
Any domain's SPF record: policy, lookup count against the limit of 10, authorized senders.
DKIM Checker
The DKIM key of any domain at its selector or the common ones, with the public key checked.
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME records for any domain — direct from Cloudflare 1.1.1.1.
Subdomain Finder
Find every subdomain a domain has ever issued a certificate for via Certificate Transparency logs.
Security Headers Checker
Grade any site's HTTP security headers — missing, weak, and what your server leaks.
DNSSEC Checker
Whether a domain is signed and validated: DS at the parent, the DNSKEY set, the chain resolvers accept.
Subdomain Takeover Checker
Subdomains whose CNAME points at a service that no longer answers, the records an attacker can claim.
security.txt Checker
A site's security.txt checked against RFC 9116: contact, expiry, canonical address, signature.