CAA Lookup

The CAA Lookup tool queries the Certification Authority Authorization records (RFC 8659) published in DNS for a domain. CAA records tell public certificate authorities which CAs are actually allowed to issue TLS/SSL certificates for a hostname — and, just as important, they let a domain owner block every other CA in the world with a single DNS record. Every publicly-trusted CA is required to check CAA before issuing, so a correct CAA policy is one of the cheapest, highest-leverage controls you can add against unauthorized certificate issuance.

This tool resolves both the exact label you enter and any inherited policy from parent labels (as required by the CAA lookup algorithm), so you see the effective policy a CA would actually enforce. We surface issue and issuewild tags, iodef reporting endpoints, the critical flag, and highlight whether a record has an empty value — the special form that means 'no CA may issue'. If the domain has no CAA record at all, we flag the wide-open state so you know any public CA can currently issue.

Use CAA Lookup before requesting a new certificate, when investigating certificate mis-issuance in a Certificate Transparency alert, when migrating between CAs (Let's Encrypt, DigiCert, Sectigo, GlobalSign, Google Trust Services, ZeroSSL, Amazon), or as part of a security-headers audit alongside our HSTS and Security Headers Grader. Combine with our CT Search to see every certificate that has actually been issued for the domain — the definitive complement to a CAA policy.