CAA Record Lookup
Query the CAA (Certification Authority Authorization) records for a domain. Check which CAs are authorized to issue SSL certificates.
What is a CAA (Certification Authority Authorization) record?
A CAA record specifies which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for a domain. Defined by RFC 8659, all CAs are required to check and honor these records since 2017.
Domains without a CAA record can receive certificates from any CA. Adding CAA records prevents unauthorized certificate issuance.
Understanding CAA record results
issue tag
Allows the specified CA to issue standard SSL certificates for the domain. Example: 0 issue "letsencrypt.org"
issuewild tag
Allows the specified CA to issue wildcard certificates (*.domain.com). If no separate rule exists, the issue rule also applies to wildcards.
iodef tag
Specifies an email or URL where the CA should send a notification if an unauthorized certificate issuance is attempted.
flags value
0 = CA may proceed even if it doesn't recognize the tag. 128 (critical) = CA must not issue if it doesn't recognize the tag.
Frequently asked questions
Yes. Without a CAA record, any CA can issue a certificate. However, adding records prevents unwanted CAs from doing so.
0 issue "letsencrypt.org" — that single line is sufficient. Add 0 issuewild "letsencrypt.org" as well if you also need wildcard certificates.
Yes. Add a separate issue record for each CA. For example, define two separate records to authorize both Let's Encrypt and DigiCert.
Need help with SSL and DNS security?
Complete your full DNS security configuration including CAA records with KodSanat.