CAA Checker

CAA Checker online: who can issue certificates for a domain

CAA (Certification Authority Authorization) is a DNS record type defined in RFC 6844/8659 that lets a domain owner explicitly specify which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for the domain and its subdomains. Since 2017, every public CA is required to check the CAA record before issuing a certificate — a mandatory CA/Browser Forum baseline requirement.

Why a CAA record matters

Without a CAA record, any of hundreds of public CAs can technically issue a certificate for a domain after a standard domain-validation challenge. If an attacker briefly gains control of a domain's DNS or web server, they could pass validation and obtain a valid certificate from an unrelated CA. An explicit CAA record narrows the set of CAs that will even consider a request, reducing the attack surface.

CAA record tags

• issue — authorizes the named CA to issue standard (non-wildcard) certificates
• issuewild — authorizes wildcard certificates (*.example.com). If absent, the issue rule applies
• iodef — a URL or email address where the CA should report attempted violations

Frequently asked questions

• What is a CAA record?

  A DNS record specifying which Certificate Authorities may issue SSL certificates for a domain. Mandatory for all public CAs to check since 2017.

• What if there's no CAA record?

  No restrictions apply — any CA can issue a certificate after standard domain validation. This is a valid default, not an error.

• How do I add a CAA record?

  Add it in your DNS zone like any other record. Example: 0 issue "letsencrypt.org" authorizes only Let's Encrypt. Multiple issue lines can list several CAs.

See also

• SSL Certificate — inspect a domain's active certificate
• TLS Details — protocol versions and cipher suites
• DNSSEC Validator — DNS chain of trust