CAA Record Lookup
Look up which certificate authorities may issue certificates.
Free, no account needed.
About CAA records
CAA records list the certificate authorities allowed to issue SSL/TLS certificates for a domain, for example Let's Encrypt or DigiCert. Authorities must check them before issuing, which reduces the risk of a certificate being issued to someone else.
Without any CAA record, every authority may issue. Remember to include the authority your hosting, CDN or email provider uses, or their certificate renewals will fail.
Frequently asked questions
Is CAA inherited by subdomains?
Yes. Authorities walk up the name tree, so a CAA record on example.com also covers www.example.com unless the subdomain has its own.
Related tools
- Dig: Online DNS LookupQuery any DNS record type the way the dig command does, from Google Public DNS or Cloudflare, with TTLs, the response status and DNSSEC validation.
- A Record LookupLook up the IPv4 addresses a hostname points to.
- AAAA Record LookupLook up the IPv6 addresses a hostname points to.
- CNAME LookupLook up the canonical name an alias points to.
- TXT Record LookupLook up the text records published for a name.