Popular tools

Theme

CAA Record Checker

This CAA record checker shows which certificate authorities may issue for a domain, as a CA reads it: parents, CNAMEs, wildcards and its certificates.

68 CAs from the CCADB · RFC 8659

CAA Record Checker: shop.example.com allows Let's Encrypt only, while Google Trust Services issued its newest certificate, with the climb a CA makes in the navy columnCAA Record Checker: shop.example.com allows Let's Encrypt only, while Google Trust Services issued its newest certificate, with the climb a CA makes in the navy columnThe verdict, per CAWho may issue, with each CA's mark, and the chip row for TLS, wildcard, S/MIME and mark certificates.Your certificatesThe certificates in use, from the Certificate Transparency logs, read against today's CAA: a CA it would refuse is named first.How a CA reads itThe climb from the name to its TLD: where the records were found, the names a CA never asks, and every CNAME on the way.ViewsEvery CA's verdict, each record in plain words with fixes, the authoritative servers and the commands to check it yourself.
A made-up shop.example.com: its CAA names Let's Encrypt, but Google Trust Services issued its newest certificate, so that CA's next renewal would fail.

What is a CAA record?

A CAA record (Certification Authority Authorization, DNS type 257) names the certificate authorities that may issue certificates for a domain. Before issuing, every CA must look for one; if a set applies and doesn't name that CA, it must refuse.

Each record holds one property: a flags number, a tag and a value. issue names a CA for certificates, issuewild for wildcards, iodef an address for reports. A name can hold many records, and the tags may repeat: one record per CA.

CAA is optional. With no record anywhere up the tree, any CA may issue. It binds CAs when they issue, not browsers: a certificate already issued stays valid when the records change.

example.com.3600INCAA0issue"letsencrypt.org; validationmethods=dns-01"
  1. nameexample.com.
  2. TTL3600
  3. typeCAA (257)
  4. flags0: not critical
  5. tagwho may issue
  6. the CA's domainLet's Encrypt
  7. parametersonly by DNS validation
One made-up record taken apart, as RFC 8659 reads it.

Sources:C13C14C19C21C52

How do CAs look up CAA?

A CA asks for CAA at the exact name first. If it finds nothing, it asks the parent, then the parent's parent, up to and including the top-level domain (never the root), and applies the first set it finds. For *.example.com it starts at example.com.

CNAMEs are followed at each name, so a name that aliases to a CDN gets the CDN's records. But the climb then goes on from the name's own parent, never from the alias target's: a host's parents don't leak onto its customers. RFC 6844, the older version, did climb the target's parents, and a few CA documents still describe that.

This is why dig CAA alone can mislead: it shows only the name you ask. The checker shows every step, and the names a CA never asks because it stopped above them.

  1. www.shop.example.comtypedno CAA
  2. shop.example.comCNAME to stores.example.netstores.example.netCAA here: applies0 issue "digicert.com"example.net never asked: an alias target's parent
  3. .the root is never asked
A made-up climb for www.shop.example.com, computed by the checker's own engine.

Sources:C7C8C9C10C11C45

issue vs issuewild

issue covers a name and its wildcards. issuewild covers wildcard certificates only, and once one issuewild record exists, the issue records stop counting for wildcards. An issuewild record alone leaves the bare name open to any CA.

So add issuewild only when wildcards need different CAs, or issuewild ";" to forbid them. A wildcard deeper down, like *.shop.example.com, follows the same set when shop.example.com has no CAA of its own.

Some CAs add the bare name to a wildcard order (*.example.com and example.com), so an issuewild-only grant can still fail there: the bare name needs issue too.

Records at example.comexample.com*.example.com*.shop.example.com
0 issue "letsencrypt.org"Let's EncryptLet's EncryptLet's Encrypt
0 issue "letsencrypt.org"0 issuewild "digicert.com"Let's EncryptDigiCertDigiCert
0 issuewild "digicert.com"any CADigiCertDigiCert
0 issue "letsencrypt.org"0 issuewild ";"Let's Encryptno CAno CA
Four made-up sets at example.com and who may issue, as the engine reads them.

Sources:C27C28C29C112

Which CAA value does my CA or host need?

Each CA publishes the domain it reads in CAA: letsencrypt.org for Let's Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert. A host or CDN needs the CAs it gets certificates from, which its own docs list.

The CCADB collects every publicly trusted CA's values in its List of CAA Identifiers; the CAs fill it in themselves, so a few spell them oddly. Where a CA's own page differs, both are shown. Retired and distrusted CAs aren't offered: Buypass stopped issuing TLS certificates, and Chrome and Mozilla no longer trust new Entrust ones.

Hosts and CDNs
Host or CAissue valuesWildcardsNote
Cloudflareletsencrypt.orgpki.goog; cansignhttpexchanges=yesssl.comsectigo.comsame as issueAdds records for its own CAs once any CAA record exists (hidden in its dashboard). Sectigo is used for backup certificates only (Cloudflare's certificate-authorities page).
Cloudflare for SaaSpki.goog; cansignhttpexchanges=yesletsencrypt.orgssl.comany onenot stated
Cloudflare Pagesletsencrypt.orgpki.goog; cansignhttpexchanges=yesssl.comsame as issue
AWS Certificate Manageramazon.comamazontrust.comawstrust.comamazonaws.comany onesame as issueACM ignores iodef.
Google Cloudpki.googletsencrypt.orgnot statedPer-project DNS authorizations use pki.goog only.
Firebase Hostingletsencrypt.orgpki.goognot stated
Azure App Servicedigicert.comno CAThe free certificate doesn't cover wildcards.
Azure Front Doordigicert.comnot stated
Vercelletsencrypt.orgnot statedAdds a Let's Encrypt record at the apex on its own DNS. When an issuewild record exists it must also permit Let's Encrypt. A name that CNAMEs to Vercel picks up Vercel's own CAA.
Netlifyletsencrypt.orgnot stated
GitHub Pagesletsencrypt.orgnot stated
Fastlycertainly.comletsencrypt.orgglobalsign.comany onenot stated
Shopifyletsencrypt.orgpki.goog; cansignhttpexchanges=yesssl.comnot statedAlready permits its CAs on domains it manages. Restricting parameters such as accounturi or validationmethods can still block Shopify.
Squarespaceletsencrypt.orgnot stated
Wixremove CAA recordsnot statedWix says CAA isn't supported and asks pointed domains to remove their CAA records.
Herokuletsencrypt.orgnot stated
Renderletsencrypt.orgpki.googsame as issue
Fly.ioletsencrypt.orgnot stated
WP Engineletsencrypt.orgpki.goog; cansignhttpexchanges=yesssl.comsame as issue
Akamailetsencrypt.orgdigicert.comnot statedAkamai prints no CAA values: these are the CAs' own (Let's Encrypt, DigiCert).
Bunny.netletsencrypt.orgnot stated
DigitalOcean load balancersletsencrypt.orgpki.googany onenot stated
DigitalOcean App Platformletsencrypt.orgpki.goognot stated
Google Sitesletsencrypt.orgnot stated
Webflowletsencrypt.orgpki.goog; cansignhttpexchanges=yesnot stated
Certificate authorities
Host or CAissue valuesWildcardsNote
Let's Encryptletsencrypt.orgnot stated
Google Trust Servicespki.goognot stated
SSL.comssl.comsame as issue
GlobalSignglobalsign.comnot stated
ZeroSSLsectigo.comnot statedZeroSSL's certificates are issued by Sectigo; zerossl.com is no CAA value.
DigiCertdigicert.comnot stated
Sectigosectigo.comsame as issueSectigo doesn't support parameters that restrict issuance further.
GoDaddygodaddy.comstarfieldtech.comany onenot stated
Certumcertum.plcertum.euany onesame as issue
Not offered
  • Buypass: Buypass stopped issuing TLS certificates; its last ones expired by 2026-10-31.
  • Entrust: Chrome and Mozilla stopped trusting new Entrust TLS certificates (from November 2024); the CAA value Entrust-branded certificates need today isn't confirmed from a primary page.
  • Azure CDN from Microsoft (classic): Managed certificates ended; the last were valid until April 14, 2026.
  • Azure Front Door (classic): Classic no longer offers managed certificates.
The values each host's or CA's own documentation prints, with a link to it.

Sources:C93C96C99C111

Generate a CAA record

List one issue record per CA you use, each with flags 0, at the apex. Leave out issuewild unless wildcards need other CAs, and add iodef only if you want reports. The Generate tab writes the set and each DNS host's own form.

Before publishing, check the CAs behind your current certificates: a set that leaves one out makes its next renewal fail. The generator warns about that before the Copy button, using the Certificate Transparency logs.

DNS hosts name the fields differently: Cloudflare asks for a tag and a CA domain name, Route 53 wants each line in one value box, and a few hosts' forms can't hold parameters or a ; record.

Zone file
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "pki.goog"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"

Cloudflare

NameTagCA domain name
@issueletsencrypt.org
@issuepki.goog
@iodefmailto:security@example.com

Amazon Route 53

Value

0 issue "letsencrypt.org"
0 issue "pki.goog"
0 iodef "mailto:security@example.com"
A made-up set for Let's Encrypt and Google Trust Services, as the zone file and two DNS hosts want it.

Sources:C21C23C104H1aH5cH5l

What does the CAA critical flag (128) do?

Flags 128 marks a record critical: a CA that doesn't understand its tag must refuse to issue. On a tag no CA knows, it blocks every CA, including the ones the issue records name. Keep flags at 0 unless you mean that.

Only the top bit counts. The other bits are reserved and ignored when read, so 130 still reads as critical and 1 reads as 0. Some DNS hosts' forms label the flag as 1 or 0: the critical bit is the value 128 on the wire.

flags 0 on an unknown tag

0 issue "letsencrypt.org"0 tbs "Unknown"

Let's Encrypt may issue

flags 128 on an unknown tag

0 issue "letsencrypt.org"128 tbs "Unknown"

every CA must refuse

  1. 000000000not critical
  2. 100000001not critical
  3. 12810000000critical
  4. 13010000010critical
The same two records with flags 0 and 128 on an unknown tag, read by the engine.

Sources:C15C16C31C44

What if my DNS can't answer CAA?

A CA can't skip a CAA lookup that fails. On a DNSSEC-signed zone every failure is a refusal. On an unsigned zone a CA may treat it as permission, but only after retrying, and many CAs refuse on any error.

A nameserver doesn't need to know CAA: it only has to answer NOERROR with no records. Failures usually come from DNSSEC signatures that break on empty answers, servers that answer NOTIMP or REFUSED to an unknown type, and firewalls that drop it (a timeout).

Signed zone (DNSSEC)Unsigned zone
NOERROR, no recordsclimbs to the parentclimbs to the parent
SERVFAIL, REFUSED or no answermust refusemay issue after a retry; many refuse
What a CA does with each answer, signed and unsigned.

Sources:C70C72C107C108C109C126

Lock CAA to your ACME account

Add accounturi to an issue record and only that ACME account may get certificates from the CA; add validationmethods and only those methods count. Every TLS CA must honour both from 15 March 2027. Until then, only some say they do.

A record with two accounturi values, or one that isn't a URI, authorizes nobody. The account URI is public, so anyone can see which domains share an account. A lock at a CA that doesn't enforce it does nothing yet.

0issue"letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890; validationmethods=dns-01"
CASays it enforces locksMethods it lists
Certumyeshttp-01ca-tbr-19dns-01ca-tbr-7ca-tbr-18ca-tbr-4
Google Trust Servicesmay–
Let's Encryptyeshttp-01dns-01tls-alpn-01
Sectigono–
62 other CAsdoesn't say

Every TLS CA from March 15, 2027

A locked record taken apart, and what each CA's own documentation says today.

Sources:C47C49C52C54C57C75C76C105C106

Does CAA cover S/MIME and mark certificates?

Yes, but not through issue. S/MIME certificates answer only to issuemail, and BIMI mark certificates (VMC and CMC) only to issuevmc. A set with issue records alone leaves both open to any CA.

The tags share one set, so a critical flag on one kind's tag can block a CA of another kind. CAs check issuemail since 2025 and list their values in their policy documents.

0 issue "letsencrypt.org"0 issue "letsencrypt.org"0 issuemail "sectigo.com"0 issuevmc "digicert.com"
TLS certificatedecided by issueLet's Encryptdecided by issueLet's Encrypt
Wildcarddecided by issueLet's Encryptdecided by issueLet's Encrypt
S/MIME (alice@example.com)decided by issuemailany CAdecided by issuemailSectigo
Mark certificate (BIMI)decided by issuevmcany CAdecided by issuevmcDigiCert
One made-up set at example.com, read for each kind of certificate.

Sources:C59C62C64C83C88C89C90

CAA record questions

How do I check for CAA records?

Enter the domain in the checker above. It asks for CAA at the name and every parent up to the top-level domain, follows CNAMEs, and shows which CAs may issue. With a terminal, dig CAA example.com +short shows the records at one name only, so run it for each parent too, since a CA keeps climbing until it finds a set.

What happens if a domain has no CAA record?

Any publicly trusted CA may issue certificates for it, as long as it validates control of the domain. CAA is optional and its absence isn't an error. A CA climbs up to the top-level domain looking for a set; when it finds none, nothing restricts issuance. Adding a set narrows that to the CAs you name.

Do CAA records apply to subdomains?

Yes. A subdomain without CAA records of its own uses the nearest parent's set, so one set at the apex covers every name below it. A subdomain that has its own records overrides the parent completely. A delegated subdomain run by someone else can publish its own set, which CAA can't prevent.

What CAA record does Let's Encrypt need?

0 issue "letsencrypt.org". That one record covers the name and its wildcards unless you also publish issuewild records, which must then name letsencrypt.org too. To lock it to your account, add ; accounturi= with the account URL your ACME client shows, and optionally validationmethods=dns-01 or http-01.

Does a CAA record affect existing certificates?

No. CAA is checked only when a certificate is issued, so certificates already out stay valid until they expire, even if today's records would refuse their CA. The next renewal is what fails. That is why the checker compares your records with the certificates in use: a CA they refuse can't renew.

What is iodef in a CAA record?

An address where a CA may send a report when it refuses a request because of your CAA records: mailto: or an https: URL. CAs aren't required to send one, many don't, and it isn't an alert service. It never restricts issuance, so a set with only iodef records lets any CA issue.

How long does a CAA change take to apply?

A CA reads CAA fresh before it issues, but resolvers cache the old set until its TTL runs out, and the CA may rely on what it read for the TTL or 8 hours, whichever is longer. Lower the TTL before a change if you need it to apply fast, then check again.

Why does my CAA lookup fail with SERVFAIL?

Most often DNSSEC: signatures that fail, sometimes only on empty answers, which most CAA answers are. Next come nameservers that answer NOTIMP or REFUSED to a record type they don't know, and firewalls that drop it. The server should answer NOERROR with no records. The Nameservers view shows which server fails.

Missing something?Suggest a feature or a new tool

Related tools