DNS · CAA · RFC 8659
CAA record checker
Find the CAA records that apply to a host name, see which certificate authorities may issue for it, and build records for your own domain. Lookups use Cloudflare’s public DNS-over-HTTPS resolver.
Check a domain
CAA record generator
How CAA works
Before issuing, a CA looks up CAA records for the exact name in the certificate. If there are none, it tries the parent domain, then its parent, up to the top-level domain (RFC 8659). The first set it finds applies; if there is none, any CA may issue.
issuenames a CA that may issue certificates.0 issue ";"forbids all.issuewildnames CAs for wildcard certificates; without it, the issue list applies to wildcards too.iodeftells CAs where to report requests that break the policy.
For a name with a CNAME, the records at the alias target count; if the target has none, the search continues with the parent of the original name.
Frequently asked questions
Do I need CAA records?
They are optional. Without them any public CA may issue for your domain. With them, a CA that is not listed must refuse, which limits the damage from a mistake or a compromised account at another CA.
Will adding CAA break my current certificates?
No. CAs check CAA only when they issue. Do list the CA that renews your certificates, and any CDN or host that obtains certificates for you, before the next renewal, or that renewal will fail.
Why does the result say the lookup failed?
The resolver answered with an error such as SERVFAIL, often caused by broken DNSSEC. A CA may refuse to issue until the DNS problem is fixed.