Free CAA record checker
Enter a domain. See the CAA records, including a parent zone when the domain itself has none, and read which issuer domains may issue a certificate.
Free, no signup. Checked October 2026. The rules on this page are from RFC 8659.
The check runs on the Uno Directory server. It queries DNS for CAA records. It does not open a TLS connection, and the domain is not added to the directory.
Type a domain such as example.com, or paste an https URL. The checker keeps the hostname and drops the path and port.
*.example.com is checked as example.com. RFC 8659 section 3 uses the name under the asterisk for a wildcard request.
Click Check CAA records. The first table is the plain-language answer for the name and for a wildcard of that name. The second table is each published tag.
Any CA. No Relevant RRset was found, or the set has no issue tag for that kind of name. CAA does not restrict issuance.
Named issuers. The issue or issuewild tag names one or more issuer domains. Only those issuers are authorized for that name.
No issuance. An issue or issuewild tag is present and names no issuer domain. The record asks that no certificate authority issue.
Depends on the name. The domain and a wildcard of that domain follow different tags. That happens when issuewild names different issuers than issue, or when only one of the two names is restricted.
Critical tag. A tag other than the known CAA properties has the critical flag set. A CA that does not support that tag must not issue.
How to read a CAA check
A CAA record is a request from the domain holder to certificate authorities. RFC 8659 section 3 says a CA must not issue when a Relevant RRset exists unless the request is consistent with that set, or an exception in the CA's certificate policy or certification practice statement applies. The same section says a set with no property that restricts issuance, such as a set that contains only iodef, does not restrict issuance. Conformance with CAA is necessary but not sufficient, and relying parties must not use the record to validate a certificate that was already issued. Checked October 2026.
The search starts at the name you entered. If the CAA lookup there is empty, the leftmost label is removed and the parent is checked, stopping before the DNS root. The examples in section 3 are the same shape: X.Y.Z with no records at any level returns an empty set, and A.B.C with a record at B.C stops there. Alias chasing stays inside the lookup for the name being processed. Section 7 explains why RFC 8659 no longer climbs the parents of a CNAME or DNAME target the way RFC 6844 did.
The issue tag is the one that grants issuance for a domain name. Section 4.2 gives the grammar: an optional issuer domain, then optional semicolon-separated parameters. issue "ca1.example.net" authorizes the holder of that domain. issue ";" authorizes nobody. A value such as %%%%% does not match the grammar and is treated as an empty issuer domain. Parameters, such as an account id the CA asked the customer to publish, mean whatever that issuer says they mean. Section 4.3 gives issuewild the same grammar for wildcard names only. If the set contains no issuewild tag, a wildcard is covered by issue. If it contains one, issue is ignored for the wildcard.
Section 4.4 defines iodef as a URL where an issuer can send an incident report. The schemes in that section are mailto, http, and https. contactemail and contactphone are separate properties in the IANA CAA property registry. contactemail is an authorized email contact for domain validation, referenced there to the CA/Browser Forum Baseline Requirements 1.6.3. contactphone is referenced to CA/Browser Forum Ballot SC14. Neither tag names an issuer. The flags octet is defined in section 4.1. Bit 0, shown as 128, is the critical flag described in section 4.5. A CA that does not understand a critical tag must not issue.
This checker does not validate DNSSEC. Section 5.1 recommends DNSSEC and says an issuer must not issue against the Relevant RRset even when the records are unsigned. Section 5.4 warns that suppressing or spoofing a CAA record can lead a CA to issue for an issuer the domain holder did not authorize. The lookup here uses public recursive resolvers. It is a reading of the records those resolvers returned, not a CA's archived proof of authorization.
The names on a certificate that is already being served are a different check. The SSL certificate checker reads the certificate from a TLS handshake, including the issuer, the dates, and the subject alternative names.
Questions
Submit a tool to Uno Directory
Built a product founders should be able to find? List it on Uno Directory. A free listing needs a backlink badge. A paid listing goes live without one.
Submit a tool