Free tool · No account needed
CAA Record Lookup
CAA records list the certificate authorities allowed to issue TLS certificates for a domain. A CA must check them before issuing, so a missing entry for the CA you use makes issuance and renewal fail.
About CAA records
What the answer tells you
- issue allows a CA to issue certificates for the name, issuewild covers wildcard certificates, and iodef gives an address to report refused requests to.
- With no CAA records at all, any CA may issue. As soon as there is one, only the CAs listed may.
- CAs check the name and then each parent domain in turn, so a record at example.com also covers www.example.com unless it has its own.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Record types
Look up any record type
Each type has a page of its own, explaining what the record does and what to look for in the answer.
- AA Record LookupIPv4 address
- AAAAAAAA Record LookupIPv6 address
- CNAMECNAME LookupAlias
- MXMX LookupMail servers
- TXTTXT Record LookupText, SPF and DMARC
- NSNS LookupNameservers
- SOASOA Record LookupZone authority
- CAACAA Record LookupCertificate authorities
- SRVSRV Record LookupService locations
- PTRReverse DNS LookupReverse DNS (PTR)
Questions
Frequently asked questions
- My certificate renewal fails with a CAA error
- The domain, or one of its parents, has CAA records that do not list your certificate authority. Add an issue record for it — for example 0 issue "letsencrypt.org" — and retry once the resolver columns show it.
- Do I need CAA records?
- No, but they are a cheap safeguard: they stop every other certificate authority from issuing a certificate for your domain if someone tricks it into trying.
- What is DNS propagation?
- DNS does not push changes out. Each resolver keeps an answer for its TTL and only asks again once that runs out, so after a change different resolvers return old and new answers for a while. When every column here agrees with the authoritative one, the change has reached them.
- What does the authoritative column show?
- The answer from one of the domain's own nameservers, which never comes from a cache. It shows what the zone says right now; the resolver columns show what the internet has cached.