CAA Lookup
See which CAs may issue certificates for a domain.
Enter a value above to run CAA Lookup
e.g. example.com
Quick answer
A CAA lookup shows which certificate authorities are allowed to issue SSL/TLS certificates for a domain. If no CAA record exists, any CA may issue certificates; when records are present, only the listed CAs are authorized.
A CAA (Certification Authority Authorization) record tells certificate authorities which of them, if any, are allowed to issue TLS/SSL certificates for your domain. This lookup reads the CAA records published in your DNS and shows the issuer tags, allowed CA hostnames, and any policy flags. If no CAA record exists, any public CA may issue for the name. Publishing the right records narrows that list and blocks unauthorized or accidental issuance, which is a simple, low-cost way to reduce the risk of mis-issued certificates.
How it works
The tool queries the domain for records of type CAA. Each record has three parts: a flag (usually 0, or 128 for critical), a tag, and a value. The main tags are 'issue' (a CA allowed to issue standard certificates), 'issuewild' (a CA allowed to issue wildcard certificates), and 'iodef' (a mailto or URL where reports of policy violations are sent). CAs are required to check these records at issuance time and refuse if their hostname is not listed.
How to read the results
Look at the tag and value on each row. An 'issue' record with value "letsencrypt.org" means only Let's Encrypt may issue for the domain; add more issue rows for each CA you use. An empty value like issue ";" forbids all issuance. 'issuewild' overrides 'issue' for wildcard names only. If the flag is 128 (critical) and a CA does not understand the tag, it must refuse to issue. No rows at all means no restriction is in place.
Common problems & fixes
The most frequent issue is a certificate order failing because your CA is not listed. Add an 'issue' record with that CA's exact hostname, for example "pki.goog" or "sectigo.com", and wait for TTL to expire. CAA is checked at the domain queried, then walked up the tree, so a record on the apex covers subdomains unless a closer record overrides it. Remember that CAA controls issuance only, not validation or existing certificates.
Frequently asked questions
- Do I need a CAA record to get an SSL certificate?
- No. Without a CAA record any public CA may issue a certificate for your domain, so certificates still work. Adding CAA is a hardening step: it restricts issuance to the CAs you trust. If you do add one, make sure every CA you actually use is listed, or their orders will be rejected.
- Why does my CA reject the order even though CAA looks correct?
- Check that the value is the CA's documented CAA identifier, not its brand name. Let's Encrypt uses "letsencrypt.org", Google uses "pki.goog", and Sectigo uses "sectigo.com". Wildcard certificates need an 'issuewild' entry or an 'issue' entry that also covers wildcards. Also confirm the record exists at the right level and that old cached values have expired.
- Does CAA affect certificates I already have installed?
- No. CAA is enforced only at the moment a CA issues a new certificate. Existing certificates keep working until they expire, regardless of your CAA records. Changing CAA also does not revoke anything. It simply governs who is allowed to issue the next certificate, including renewals, for the domain.