SSL CAA Checker

Check Certification Authority Authorization records for any domain

Querying CAA records for ...

About CAA Record Checker

Our free CAA Record Checker verifies Certificate Authority Authorization (CAA) DNS records for any domain. CAA records specify which Certificate Authorities are allowed to issue certificates for your domain, preventing unauthorized certificate issuance.

How to Use

1Enter the domain name to check.
2Click "Check CAA" to query CAA DNS records.
3Review which CAs are authorized and their issue/issuewild flags.

Use Cases

•Verify CAA records before certificate ordering
•Prevent unauthorized certificate issuance
•Comply with security policies
•Audit CA authorization

Technical Details

CAA Flags

0 (issue), 128 (issuewild), 32 (iodef)
Per-domain and wildcard records

Supported CA Tags

letsencrypt, digicert, sectigo, etc.
Multiple CAs can be authorized

Tips & Best Practices

•Add CAA records before ordering certificates to avoid issuance failures
•Include your primary CA and a backup CA in CAA records
•Use the iodef flag to receive reports of unauthorized issuance attempts

Frequently Asked Questions

Any CA can issue certificates for your domain. Add CAA records to restrict which CAs are authorized.

Yes, add multiple CAA records with different CA tags to authorize multiple certificate authorities.

The issuewild flag controls which CAs can issue wildcard certificates (*.example.com).

Video Tutorial

Video tutorial coming soon