Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

CAA record check

Shows which certificate authorities are allowed to issue for your domain, and whether the record you published says what you think it says.

Judged against RFC 8659 section 4

Free, instant, no signup. This test reads your live DNS the way a receiving server does.

Symptoms

There is no symptom, until there is an incident. CAA is preventive: the failure it stops is somebody obtaining a valid certificate for your domain from a CA you have never dealt with, and using it to impersonate you convincingly.

The one visible failure mode is the opposite, a certificate renewal that suddenly fails because the CAA record omits the CA your provider actually uses.

Diagnosis

A CAA record is a short list of properties. issue names an authority that may issue ordinary certificates, issuewild covers wildcards, and iodef gives a contact for reporting attempts. Anything else is ignored by every CA, so a typo here produces a record that looks protective and is not.

Cure

  1. List every CA you use. Include the ones your CDN, load balancer or host renews for you. That is the one people forget.
  2. Publish them, e.g. yourdomain.com. CAA 0 issue "letsencrypt.org".
  3. Add an iodef contact so you hear about refused attempts.
  4. Re-check after your next renewal to confirm nothing was quietly blocked.

Questions people actually ask

What does a CAA record do?

It names which certificate authorities may issue certificates for your domain. Every CA is required to check it before issuing, so it turns "any CA on earth" into a list you chose.

Does CAA affect email?

Indirectly, and increasingly. MTA-STS depends on a valid certificate on your policy host, and DANE depends on certificates directly. CAA is what stops somebody obtaining a certificate for your name from a CA you have never used.

Will a CAA record break my certificate renewals?

Only if you forget a CA you actually use. List every issuer in your stack, including the one your CDN or hosting provider renews on your behalf, before relying on it.

What does issue ";" mean?

It forbids all issuance for that name. It is a deliberate lock for domains that should never have a certificate, and it stops your own renewals too.

Related tests

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.