Free tool
See which certificate authorities are allowed to issue SSL certificates for a domain.
Enter a domain to look up its CAA records.
A CAA (Certification Authority Authorization) record lists which certificate authorities are permitted to issue SSL/TLS certificates for your domain. CAs are required to check it before issuing.
CAA records are a strong defence against mis-issuance: if an attacker tries to obtain a certificate from a CA you have not authorised, the CAA record blocks it. This tool shows your domain's CAA policy.
A domain that uses two CAs, refuses wildcard certificates and wants reports of blocked requests might publish:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "pki.goog"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"
Every CAA record has a flag, a tag and a value. The flag is almost always 0. A flag of 128 marks the record as critical: a CA that does not understand the tag must refuse to issue.
The issue tag names a CA that may issue ordinary certificates, one record per CA. issuewild does the same for wildcard certificates; with no issuewild record, the issue records cover wildcards too. A value of ";" authorises no CA at all, so the example allows Let's Encrypt and Google Trust Services for ordinary certificates and blocks wildcards entirely. iodef gives an address where a CA can report a request that broke your policy.
Before issuing, a CA checks the exact name on the certificate, then climbs to each parent domain in turn and applies the first set of CAA records it finds. If there are none all the way up, any public CA may issue.
This tool looks up the exact name you enter, not its parents. If www.example.com shows nothing, look up example.com as well: that is the policy a CA would apply. The table shows Flag, Tag and Value for each record, and the bar shows the record count and query time.
Lookups run live from the PulseStack™ server in the UK against Google Public DNS (8.8.8.8), with Cloudflare (1.1.1.1) as the fallback, and nothing is stored.
Renewal blocked after changing CA. The record still names only the old CA, so the new one has to refuse. Add the new CA's value before you switch, and remove the old one once you no longer use it.
Your host or CDN uses another CA. Managed certificates from a hosting platform or CDN may come from a CA you did not choose, or from more than one. Check its documentation and list every CA it may use.
Wildcards blocked. An issuewild record of ";", or one naming a different CA, stops wildcard certificates even when the issue records allow your CA.
A typo in the value. The value must match the CA's published domain exactly: letsencrypt.org works, while letsencrypt.com blocks Let's Encrypt.
DNS errors instead of empty answers. If your DNS server returns an error for CAA queries rather than an empty answer, CAs may treat that as a reason not to issue. This mostly affects old or unusual DNS software.
CAA only matters when a certificate is issued or renewed, so a blocked renewal first shows up as a certificate counting down to expiry. The SSL checker shows the current certificate's issuer and expiry date, and SSL monitoring alerts you a set number of days before it expires. If a certificate has already lapsed, the guide to an expired SSL certificate covers the causes and fixes.
On macOS or Linux, run dig CAA example.com +short. dig prints the flag, tag and value in the same order as the table above. Remember that CAs climb the tree, so query the parent domain too when you check a subdomain.
Windows is less helpful: neither nslookup nor PowerShell's Resolve-DnsName recognises the CAA type. Use dig in WSL, or ask Google Public DNS over HTTPS from PowerShell with (Invoke-RestMethod "https://dns.google/resolve?name=example.com&type=CAA").Answer, where the data column holds each record.
For a domain's other records, use the DNS lookup.
It is optional but recommended. Without one, any public CA may issue certificates for your domain. A CAA record restricts issuance to CAs you trust, reducing the risk of fraudulent certificates.
The issue tag authorises a CA to issue standard certificates, issuewild covers wildcard certificates, and iodef gives a contact address for CAs to report policy violations.
No. CAA is only checked at issuance time. Existing certificates continue to work. Just make sure your record authorises the CA you plan to renew with.
Yes, unless a subdomain has its own. A CA checks the exact name on the certificate first, then each parent in turn, and uses the first set of CAA records it finds. A CAA record on example.com therefore applies to www.example.com and shop.example.com, but a subdomain that publishes its own CAA records replaces the parent's policy.
Each CA publishes the domain to put in the issue tag. Let's Encrypt uses letsencrypt.org, Google Trust Services uses pki.goog, DigiCert uses digicert.com and Sectigo uses sectigo.com. Check your CA's documentation, as some accept more than one value.
Every one runs a real check, live, with nothing to install.
PulseStack™ SSL certificate monitors check your certificate as often as every hour and alert you a set number of days before it expires (7 by default). Included from the Starter plan at £9 a month, with a 14-day trial and no card.