All tools

CAA Record Lookup

See certificate-authority authorisation records published at a domain name.

Enter the exact hostname whose records you want to inspect.

Enter a value above to start. No account needed.

How this check works

We retrieve CAA records at the name you enter. issue authorises certificate issuers, issuewild covers wildcard certificates, and iodef can specify an incident-reporting destination.

What this check does not prove

This is an exact-name lookup, not a complete certificate-authority authorisation decision. CAA processing can follow aliases and ancestor policies, so an empty answer does not prove that no restrictions apply.

Does CAA install an SSL certificate?

No. It tells certificate authorities who may issue certificates. Your web server still needs a correctly installed certificate.

Do CAA changes revoke existing certificates?

No. CAA is checked during issuance; changing a record does not automatically revoke an existing certificate.