--- title: Free CAA Record Lookup description: Check which certificate authorities a domain allows — its CAA issue, issuewild and iodef records, or the absence of any. Find out before a certificate order fails with 'CAA record prevents issuance', and confirm the policy covers the CA you actually use. canonical: https://watchfor.io/caa-record-lookup --- [Back to all free tools](/free-tools) # CAA Record Lookup Check which certificate authorities a domain allows — its CAA issue, issuewild and iodef records, or the absence of any. Find out before a certificate order fails with 'CAA record prevents issuance', and confirm the policy covers the CA you actually use. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is CAA Record Lookup ? A CAA record lets a domain owner say which certificate authorities are allowed to issue certificates for the domain. Since 2017 every publicly trusted CA must check it before issuing: if example.com has 0 issue "letsencrypt.org" , then DigiCert, Sectigo, Google Trust Services and everyone else must refuse to issue for example.com and its subdomains. No CAA record means any CA may issue — which is the default for most of the internet. This tool returns the CAA records for a name and, because CAA is inherited, tells you what applies when the name itself has none. Use it before a certificate order fails with "CAA record prevents issuance", after switching CAs, and to confirm a policy actually restricts issuance to the CAs you use — including for wildcards, which have their own tag. ## How it works A CA evaluates CAA by climbing the name tree; this tool shows what it finds: - 1 Query `QTYPE=CAA` on the exact name — If records exist there, they are the policy — nothing higher up is consulted. - 2 Climb to the parent if empty — No CAA on www.example.com ? The CA checks example.com , then com (which never has any). The first name with records wins. Query the parent yourself to see the inherited policy. - 3 Read the tags — issue permits a CA to issue regular certificates, issuewild covers wildcards, iodef gives an address where the CA should report violations. A ; as the value means "nobody". The flags field is normally 0 . 128 marks a critical property that a CA must understand or refuse issuance — rarely used, and a reason for mysterious refusals when it is. ## When you'd use it ### Certificate issuance refused The ACME client or CA portal reports a CAA error. Look up the name and its parents: a record naming another CA (often left over from a previous vendor) is blocking the one you use now. ### Switching certificate authorities Before ordering from the new CA, add its identifier to the CAA set — and keep the old one until the last certificate from it has been replaced, or renewals fail. ### Locking down who can issue Without CAA, a mis-issued certificate from any CA in the world would be technically valid for your domain. Publishing issue records for only the CAs you use closes that door — and a CAA lookup verifies the door is actually closed. ### Wildcard certificates failing issue alone does not permit wildcards once any issuewild record exists. If your wildcard renewal started failing after someone added CAA records, this is why. ## Reading the result ### issue The CA's domain identifier, e.g. letsencrypt.org , digicert.com , pki.goog , sectigo.com , amazon.com for ACM. Several issue records permit several CAs. Optional parameters after ; (like accounturi= , validationmethods= ) restrict further. ### issuewild Same, for wildcard certificates. If no issuewild exists, issue governs wildcards too; once one exists, only it does. ### iodef mailto: or https:// where a CA should report an issuance request it refused. Useful for detecting someone trying to obtain certificates for your domain. ### No records anywhere up the tree Any CA may issue. Not a vulnerability by itself, but the reason CAA exists. ## Check it yourself dig CAA example.com @1.1.1.1 +noall +answer Empty? Try the parent name — the policy that applies is the nearest one up the tree. ## Common pitfalls ### Blocking your own CDN's certificates Cloudflare, Fastly, AWS CloudFront and Vercel issue certificates for your names through their own CA partners. A restrictive CAA set without those CAs breaks their automatic certificates. Providers document which identifiers to allow. ### Restricting a subdomain by accident A CAA record on the apex applies to every subdomain that lacks its own. That includes the SaaS-hosted status.example.com that needs a certificate from a CA you didn't list. ### Adding `issuewild ";"` and forgetting the wildcard renewal issuewild with an empty value forbids all wildcard issuance. Correct for a domain that never uses wildcards; a surprise for one that does. ## Run CAA Record Lookup on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What should a CAA record for Let's Encrypt look like? example.com. CAA 0 issue "letsencrypt.org" . Add 0 issuewild "letsencrypt.org" if you use wildcards, and optionally 0 iodef "mailto:security@example.com" . Is a CAA record required? No. Without one, any CA can issue. It's a hardening measure that costs one DNS record and prevents mis-issuance by CAs you don't use. Do CAA records apply to subdomains? Yes — a subdomain without its own CAA inherits the nearest ancestor's. A subdomain with its own records overrides the parent completely. Why does issuance fail even though I added the CA? Caching: the CA saw the old record. Or the name has its own CAA that overrides the one you edited. Or you added issue but the order is a wildcard and an issuewild record excludes the CA. Which CA identifier do I use? Each CA publishes it: letsencrypt.org , digicert.com , sectigo.com (and comodoca.com ), globalsign.com , pki.goog (Google Trust Services), amazon.com / amazontrust.com (AWS ACM), ssl.com . Check the CA's CAA documentation; some accept several. ## Related dns tools - [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.](/dns-checker) - [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map.](/dns-propagation-checker) - [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.](/whois-lookup) - [A Record LookupFind the IPv4 address a domain resolves to — every A record with its TTL, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short.](/a-record-lookup) --- Canonical page: https://watchfor.io/caa-record-lookup · Site guide: https://watchfor.io/llms.txt