Authorizes a CA to issue normal certificates.
DNS security
CAA record checker
See which certificate authorities a domain explicitly authorizes to issue TLS certificates.
Quick guide
What CAA records do
CAA records let a domain owner state which certificate authorities may issue certificates for the domain. Browsers do not read CAA during normal page loads; certificate authorities check it during issuance.
This page reports CAA records published directly on the domain you enter. DNS CAA processing can also involve ancestor labels when no record exists at the exact name.
Controls authorization for wildcard certificates.
Provides a contact/reporting destination for policy violations.
CAA records are read from DNS and grouped by tag to show which certificate authorities a domain explicitly authorises to issue certificates.
- Auditing certificate-authority policy
- Troubleshooting certificate issuance
- Checking whether wildcard issuance is restricted
Terminal shortcut
Prefer the command line?
Inspect CAA policy from a short command.
> caa example.com
Run in Terminal ->