How to Check a Domain's CAA Records (Who Can Issue Its SSL Certificates)

To check a domain's CAA records, look up the CAA record at the host name, then at each parent name, and stop at the first one you find. That is how a certificate authority reads it. The CAA record checker does the walk for you, for up to 100 host names a run (500 after a free Google sign-in), and shows the CAs allowed to issue for ordinary and wildcard certificates, or Any CA when there is no record.

If you are about to order a certificate, this check takes a minute and can save a failed issuance.

What a CAA record is

A CAA (Certification Authority Authorization) record is a DNS record that names the CAs allowed to issue certificates for a domain. It is defined in RFC 8659. Three tags matter:

Tag	Meaning
issue	CAs allowed to issue ordinary certificates
issuewild	CAs allowed to issue wildcard certificates
iodef	An address where a CA can report a refused request

A value of ; allows no CA at all. Since September 2017 every publicly trusted CA has had to check CAA before issuing, under section 3.2.2.8 of the CA/Browser Forum Baseline Requirements. If the record does not name the CA, it must refuse.

Step 1: paste the host names

Paste domains or host names, one per line. www.example.com and example.com are checked separately, because each can have its own CAA record. Use up to 100 a run without an account, or 500 after a free Google sign-in.

Step 2: run the check

Each name is looked up in DNS, then its parent, and so on, stopping at the first name with CAA records. RFC 8659 section 3 sets that order: the exact name first, then the parent, then the parent's parent. So a CAA record on example.com covers shop.example.com unless shop.example.com publishes its own. The checker shows which name the record came from.

Step 3: read the result

Result	What it means
Restricted	Only the CAs named may issue. The row lists them
Any CA can issue	No CAA record up the tree. This is the default
No CA can issue	The record is ;, so issuance is blocked

The row also shows where the record came from and the raw records.

Which identifier does my CA use

Each CA publishes the domain names it recognises in its policy documents, and Mozilla's CCADB collects them. Common ones are letsencrypt.org for Let's Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert, sectigo.com for Sectigo, amazon.com for Amazon, globalsign.com for GlobalSign and ssl.com for SSL.com. The checker names those it knows and shows any other identifier exactly as published. Let's Encrypt documents its own use at letsencrypt.org/docs/caa.

Before ordering, confirm your CA's identifier is in the issue list, and in issuewild if you want a wildcard certificate.

Step 4: tighten CAA without breaking renewals

Some hosts issue through more than one CA. A CDN that renews certificates automatically may need two or three identifiers listed. Check your provider's documentation before adding or tightening a CAA record, or the next renewal can fail. After a change, wait for the old record's TTL before retesting.

To see which CA actually issued each live certificate and when it expires, use the bulk SSL checker and read how to check SSL certificate expiry for many websites. To see the raw DNS, use the DNS lookup.

When a certificate request fails a CAA check

The message usually says the CA could not issue because of a CAA record. Run the check on the exact name in the request. If the record comes from a parent, that is the one to edit. Add the CA's identifier to an issue record (or issuewild for a wildcard), wait for the TTL, and try again.

What this check cannot do

• It reads DNS through one resolver. It cannot tell whether a CA's own check, which may use DNSSEC, would see the same answer.
• It does not evaluate account or validation-method parameters (accounturi, validationmethods). It shows them as published.
• CA names are given only for commonly used identifiers. Others appear as the raw domain.
• It does not check which certificates already exist.
• The limit is 100 host names a run without an account and 500 signed in.

Does CAA affect email

No. CAA controls who can issue TLS certificates and nothing else. Email delivery depends on MX, SPF, DKIM and DMARC. If you are sending from the domains you are auditing, check the addresses you send to on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Check your host names now

Paste them into the CAA record checker.