DNS Tools

CAA Record Lookup

See which certificate authorities a domain allows to issue SSL certificates for it.

Not sure what to enter? Try an example: google.com

Free & instant No signup How to use FAQ

Enter a domain to see its CAA records - the DNS rule that tells certificate authorities whether they may issue a certificate for it.

What is a CAA record?

A CAA (Certification Authority Authorization) record lists which certificate authorities may issue SSL/TLS certificates for a domain. Authorities must check it before issuing, so a correct CAA record stops certificates being issued by a provider you do not use.

How to look up CAA records

Enter the domain in the box above.
Click Look Up CAA.
Make sure the authority that issues your certificates (for example letsencrypt.org) is listed.
If certificate renewal fails with a CAA error, add an issue record for your certificate authority.

Related checks

To see the certificate currently installed, use the SSL Certificate Checker.
To see every record type at once, use the DNS Lookup.

If you renew certificates automatically, make sure the CA you use is listed above, or the renewal will be refused. JustChecker alerts you before your SSL certificate expires, so a blocked renewal never turns into a browser warning.

Frequently Asked Questions

Yes. If CAA records exist and do not list your certificate authority (for example letsencrypt.org), it must refuse. Add a CAA record for the CA you use, then request again.

No. With no CAA record any public CA may issue for your domain. Adding one is a simple extra safeguard against certificates being issued by a provider you don't use.

It gives an email address or URL where a CA can report a refused certificate request for your domain - an early warning that someone tried to get a certificate.

Share this tool:

Need a website for your business? Only $599