CAA record checker: which certificate authorities may issue for this domain?
In short: Paste domains or host names and see, for each, the CAA record a CA would use (its own or a parent's), the CAs allowed for ordinary and wildcard certificates, and where refusals are reported. Limit: It reads DNS through one resolver; it can't tell you whether a CA's own check, which may use DNSSEC, would see the same answer.
A CAA record checker shows which certificate authorities a domain allows to issue its SSL certificates. Paste one host name or up to 100 (500 after a Google sign-in): each is looked up the way a CA must, at the name and then each parent until a CAA record is found, and you get the allowed CAs for ordinary and wildcard certificates, or Any CA when there's none.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
Only Let's Encrypt and Google Trust Services may issue certificates for acme.example.
- Host
- shop.acme.example
- Found at
- acme.example
- issue
- Let's Encrypt, Google Trust Services
What this means for you
Check your CA is allowed before you order or renew, and see which hosts allow any CA.
- Reads CAA the way a CA must
- Inherited records traced to their name
- Common CA identifiers named
- 100 hosts a run, 500 when signed in
- CAA
- Certificates
- DNS
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français
Auditing every host name in a company or client portfolio?
- Paste up to 500 hosts a run when signed in and download the CSV after each.
- Pair it with the bulk SSL checker to see which CA actually issued each live certificate and when it expires.
- Sending email from these domains? Check the list you send to at /verify. The first 100 email checks are free with a Google sign-in, no card.
How do I check a domain's CAA records?
- Paste domains or host names, one per line: up to 100 a run, or 500 after a free Google sign-in. www.example.com and example.com are checked separately, because each can have its own CAA.
- Press Check CAA records. Each name is looked up in DNS, then its parent, and so on, stopping at the first name with CAA records.
- Read the result: Restricted (with the CAs named), Any CA can issue, or No CA can issue, plus where the record came from and the raw records.
- Getting a certificate? Make sure your CA's identifier, such as letsencrypt.org or pki.goog, is in the issue (or issuewild) list before you order.
Example
- You enter
- Three host names:
acme.example,shop.acme.exampleandglobex.example. - You get
acme.exampleRestricted: only Let's Encrypt (letsencrypt.org) and Google Trust Services (pki.goog) may issue.shop.acme.exampleRestricted, inherited from acme.example because it has no CAA of its own.globex.exampleAny CA can issue, because no name up the tree has a CAA record. Download the CSV with the raw records.- Limits
- Up to 100 host names a run without an account and 500 when signed in with Google.
What is a CAA record?
A CAA (Certification Authority Authorization) record is a DNS record that names the certificate authorities allowed to issue certificates for a domain, defined in RFC 8659. The issue tag lists CAs for ordinary certificates, issuewild lists CAs for wildcard certificates, and iodef gives an address where a CA can report a refused request. A value of ";" allows no CA.
Since September 2017 every publicly trusted CA has had to check CAA before issuing, under the CA/Browser Forum Baseline Requirements (section 3.2.2.8). If the record doesn't name the CA, it must refuse.
Why does a subdomain show its parent's CAA record?
Because that's how CAs read it. RFC 8659 section 3 says the CA looks for CAA at the exact name first; if there's none, it tries the parent, then the parent's parent, and uses the first record set it finds. So a CAA record on example.com covers shop.example.com unless shop.example.com publishes its own. The checker follows the same walk and shows the name the record came from.
No CAA record anywhere up the tree means any publicly trusted CA may issue. That's the default, and most domains have none.
Which CAA identifier does my CA use?
Each CA publishes the domain names it recognises in its policy documents, and Mozilla's CCADB collects them. Common ones: letsencrypt.org for Let's Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert, sectigo.com for Sectigo, amazon.com for Amazon, globalsign.com for GlobalSign and ssl.com for SSL.com. The checker names those it knows and shows any other identifier exactly as published.
Some hosts issue through more than one CA; a CDN that renews automatically may need two or three identifiers listed. Check your provider's documentation before tightening CAA, or renewals can fail.
Who uses this tool, and for what?
- IT teams
- Confirm every company host allows only the CAs you've approved, and find the ones with no CAA at all.
- Agencies
- Before moving a client to a new host or CDN, check that its CA is allowed, so certificate renewals don't fail.
- Security reviewers
- List which CAs could issue for a portfolio of domains as part of an audit.
- Developers
- Debug a certificate order refused for CAA by seeing exactly which record, at which name, the CA read.
What can’t this tool tell you?
- It reads DNS through one resolver; it can't tell you whether a CA's own check, which may use DNSSEC, would see the same answer.
- It doesn't evaluate account or validation-method parameters (accounturi, validationmethods); it shows them as published.
- CA names are given only for commonly used identifiers; others are shown as the raw domain.
- It doesn't check which certificates already exist; use the bulk SSL checker for the live one.
- Up to 100 host names a run without an account and 500 signed in.
Common questions
- How do I check CAA records?
- Paste the host name here. The checker reads CAA at the name and then each parent until it finds a record, like a CA does, and lists the CAs allowed to issue.
- What happens if a domain has no CAA record?
- Any publicly trusted CA may issue certificates for it. CAA is optional; most domains don't publish one.
- What's the difference between issue and issuewild?
- issue covers ordinary certificates; issuewild covers wildcard certificates such as *.example.com. If there's no issuewild tag, the issue list applies to wildcards too.
- Why did my certificate request fail a CAA check?
- The domain, or a parent of it, has a CAA record that doesn't list your CA. Add the CA's identifier to an issue record (or issuewild for a wildcard), wait for the old record's TTL, and try again.
- Does a CAA record affect email?
- No. CAA only controls who can issue TLS certificates. Email delivery depends on MX, SPF, DKIM and DMARC.
- Is the CAA checker free?
- Yes. 100 host names a run without an account and 500 after a free Google sign-in, no card.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.