CAA Record Checker

What the CAA checker looks at

CAA records (RFC 8659) list the certificate authorities allowed to issue TLS certificates for a domain. Before issuing, a CA looks up CAA at the exact name. If that name has no CAA records, it tries the parent, then the parent's parent, until it finds a set. The checker does the same climb and shows which name supplied the records that apply.

• issue: CAs allowed to issue certificates for the name, including wildcards when there is no issuewild.
• issuewild: if present, it replaces issue for wildcard certificates.
• iodef: where CAs may report a refused request (mailto: or https:).
• Parameters such as accounturi and validationmethods (RFC 8657), which tie issuance to a specific ACME account or validation method.
• Critical flag (128) on an unknown tag, which tells every CA that does not understand the tag to refuse issuance.

How to read the result

Each issuer domain is mapped to the CA that uses it (for example pki.goog is Google Trust Services and amazon.com is Amazon Trust Services). A value of ; alone means no CA may issue. If no CAA record exists anywhere up the tree, any publicly trusted CA may issue.

Common problems

• Certificate renewals failing after adding CAA: your CDN or hosting provider issues through a CA you did not list. Add its issuer domain.
• Wildcard blocked: an issuewild ";" record, or an issuewild list that leaves out your CA.
• Subdomain behaves differently: a CAA record on the subdomain, or on the target of its CNAME, overrides the parent's records completely.

To see the certificate a site currently serves, use SSL Certificate Checker.