Check CAA Records
Enter a domain to look up its DNS Certification Authority Authorisation records
Looking up CAA records for …
issue (regular certificates)
issuewild (wildcard certificates)
iodef
What are CAA Records?
DNS CAA (Certification Authority Authorisation) records let domain owners specify which Certificate Authorities are permitted to issue SSL certificates for their domain. Without CAA records, any CA can issue a certificate — CAA records add an important layer of misissuance protection.
issue tag
Controls which CAs may issue regular (non-wildcard) certificates. issue "letsencrypt.org" permits only Let's Encrypt.
issuewild tag
Controls wildcard certificate issuance independently. If absent, the issue policy applies to wildcards too.
iodef tag
An email or URL where the CA should report policy violations or misissuance attempts for your domain.
Inheritance
If a subdomain has no CAA records, CAs check the parent domain. Records at example.com protect sub.example.com too.
Need a Free SSL Certificate?
Generate a trusted SSL certificate powered by Let's Encrypt - completely free.