CAA Record Checker

Without a CAA record, any of the publicly trusted certificate authorities can issue a certificate for your domain to anyone who passes that CA's validation. A CAA record narrows that to the CAs you actually use, which limits the damage if a different CA's validation is tricked or misconfigured.

Checking CAA has been mandatory for all public CAs since September 2017 under the CA/Browser Forum Baseline Requirements. The record format is defined in RFC 8659.

CAA also causes outages. If you switch certificate providers — or your hosting platform does — and the CAA record still names only the old CA, the next renewal fails. That is the most common reason to end up on this page.

Inherited rules. A CA looks for CAA records on the exact name first, then on each parent in turn — app.eu.example.com, eu.example.com, example.com — and uses the first set it finds. The checker does the same and tells you which name the rules came from, so a subdomain shows its parent's policy rather than "no record".

No CAA record anywhere is not an error. It means every CA is allowed, which is the default for most domains.

A domain using Let's Encrypt for normal certificates and wildcards, with violation reports sent to the security team:

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:security@example.com"

If a certificate request fails with a CAA error, the CA you are using is not in the list that applies to the name.

• Run this check on the exact hostname that failed, not just the root domain.
• Note which name the rules came from. A record on the parent domain applies to every subdomain beneath it.
• Add an issue record for the new CA next to the existing ones, or replace the old value.
• For a wildcard certificate, check issuewild too — an issuewild ";" blocks wildcards even when issue allows the CA.
• Wait for the old record's TTL to pass, then retry the request.

A CNAME on the name being checked is followed: the CA uses the CAA records of the CNAME's target. If a subdomain is aliased to a provider, that provider's CAA policy applies to it.