CAA record lookup
CAA records let a domain owner restrict certificate issuance using tags such as issue, issuewild, and iodef.
Enter a root domain or subdomain—no protocol or path needed.
How CAA is evaluated
A certificate authority checks CAA before issuing a certificate. If no CAA record exists at the requested name, the search can continue up the DNS hierarchy according to the CAA processing rules.
The issue tag controls ordinary certificates, issuewild controls wildcard certificates, and iodef provides a reporting contact. A missing CAA policy does not itself mean a certificate is insecure.
Before changing CAA
- List every certificate authority your services use.
- Include wildcard authorization when needed.
- Account for hosting and CDN providers that issue certificates automatically.
- Allow for DNS caches before requesting a certificate.
Quick answers
Frequently asked questions
Is CAA required for HTTPS?
No, but it can reduce the set of certificate authorities permitted to issue for your domain.
Can CAA block certificate renewal?
Yes. An overly restrictive or outdated policy can prevent automated renewal.