issue directives (Non-wildcard certs)
Which CAs are allowed to issue standard (non-wildcard) certificates. Empty string `";"` = no CA may issue.
CAA Record Lookup — see which certificate authorities can issue for a domain.
Query CAA (Certification Authority Authorization) records for any domain in real time. CAA tells CAs which issuers are allowed to sign certificates for the domain — a five-minute defence against mis-issuance. Returns every issue and issuewild directive, iodef reporting address, and walks the tree-climbing chain to show where in the parent hierarchy the CAA actually lives.
01 · TRY IT
Look up CAA records
Authoritative query with tree-climbing awareness — surfaces both direct CAA and inherited-from-parent CAA.
02 · WHAT IT RETURNS
What the CAA lookup shows
issuewild directives (Wildcard certs)
Which CAs may issue wildcard certificates (`*.example.com`). Often narrower than issue — you might allow LE for standard certs but require DigiCert for wildcards.
iodef reporting (Mis-issuance alerts)
Where CAs report mis-issuance attempts. Should be a mailto: address you actively monitor. Free early warning about attackers trying to mint certs for you.
Tree-climbing behaviour (RFC 8659)
CAA is inherited — if the queried domain has no CAA, resolvers walk up the parent chain. This tool shows where in the chain the effective CAA lives.
CA identifier fingerprints (Auto-detected)
letsencrypt.org, digicert.com, sectigo.com, globalsign.com, amazon.com, pki.goog, and 15+ others recognised and labelled.
Deployment recommendations (AI verdict)
AI checks your live cert issuer against your CAA policy — flags mismatches ("your cert is issued by LE but your CAA doesn't allow it").
03 · WHY IT MATTERS
When to check CAA
- New domain hardening Adding CAA is one of the cheapest security wins available. Lock issuance to your known CAs so a compromised third-party CA can't mint valid certs for you.
- Mis-issuance monitoring Publish an iodef mailto and CAs will notify you when someone attempts unauthorised issuance. Free early-warning intel about targeted attacks.
- Automation troubleshooting Cert renewal failing? Check whether the CAA blocks your automation's CA. Common failure mode after switching cert providers.
- M&A cert audit Acquiring a company? Their CAA policy tells you which CAs they use — critical for consolidating certificate authorities post-acquisition.
- Compliance evidence SOC 2, ISO 27001, PCI DSS auditors increasingly ask for evidence of cert-issuance controls. CAA + iodef monitoring is a defensible answer.
04 · QUESTIONS
Common questions
- What is a CAA record? A DNS record that tells the world which certificate authorities may issue TLS certificates for a domain. RFC 8659 requires CAs to check CAA before issuing — a mismatch aborts issuance.
- Should every domain have CAA? Yes if you know your CAs. Publishing CAA locks the issuance surface — anyone compromising a different CA cannot mint valid certs for you. Absence of CAA lets any trusted CA issue.
- What's the difference between issue and issuewild? `issue` covers non-wildcard certs. `issuewild` covers wildcard certs. If you don't publish issuewild but do publish issue, wildcards fall back to the issue rules.
- What does iodef do? Reporting inbox for CAs to send mis-issuance alerts to. Format: `0 iodef "mailto:[email protected]"` or `0 iodef "https://your.reporting.endpoint/"`. Should always be present when CAA is set.
- Does CAA cascade from parent? Yes — CAA is tree-climbing. If `foo.example.com` has no CAA, CAs check `example.com`, then the TLD. First non-empty CAA wins. A CAA at your apex protects every subdomain by default.
05 · RELATED
Related security + DNS tools
SSL Certificate Checker (Live cert)
Check the currently-deployed cert against your CAA policy.
TLSA (DANE) Lookup (DNS pinning)
Advanced cert pinning via DNSSEC-backed TLSA records.
DS Record (DNSSEC) (Signed zone)
Verify DNSSEC — without it, CAA and TLSA lose integrity guarantees.
DNS Query (All Records) (Super tool)
Full DNS dump including CAA alongside every other record.