Skip to content
LookupOwl

CAA record lookup

See which certificate authorities may issue certificates for a domain, and how records on parent names apply.

A host name works too, like mail.example.com.

More options

Which DNS server to ask. The default is Cloudflare; pick "the domain's own nameserver" to skip every cache and see exactly what the zone publishes.

Set the DNSSEC OK bit: include RRSIG records and report whether the resolver validated the answer (AD flag).

Try:

Results for google.com

Checked live lookup24 ms

JSONCheck again

NOERROR

1 record found

Everything came back normally. Open any type below to copy its values.

CAA · 1
Record mix
  • CAA1 of 1

1 record in 1 type.

Answered in
24ms

Cloudflare

Lowest TTL
1day

Changes reach caches within this time

DNSSEC
Not checked

Turn on DNSSEC in More options to check

CAA1
NameTTLValue
google.com1 d0 issue "pki.goog"
Structured result (JSON) · 679 B
{
  "name": "google.com",
  "type": "CAA",
  "resolver": "cloudflare",
  "resolverName": "Cloudflare",
  "rcode": "NOERROR",
  "ad": false,
  "dnssec": false,
  "ms": 24,
  "records": [
    {
      "name": "google.com",
      "type": "CAA",
      "ttl": 86400,
      "data": "0 issue \"pki.goog\"",
      "fields": {
        "flags": 0,
        "tag": "issue",
        "value": "pki.goog",
        "critical": false
      }
    }
  ],
  "authority": [],
  "queries": [
    {
      "type": "CAA",
      "rcode": "NOERROR",
      "records": 1,
      "ms": 24,
      "ad": false
    }
  ],
  "ede": [],
  "notes": [],
  "truncated": false,
  "server": "1.1.1.1",
  "minTtl": 86400
}

What CAA records control

A CAA (Certification Authority Authorization) record is a DNS entry where you name the certificate authorities (CAs) allowed to issue TLS certificates for your domain. Since September 2017, CAs must check CAA before they issue. So a record that names only your chosen CA makes every other CA refuse a mistaken or malicious request for your domain.

Example recordWhat it permits
0 issue "letsencrypt.org"Only Let's Encrypt may issue certificates for this name.
0 issuewild "digicert.com"Only DigiCert may issue wildcard (*.) certificates.
0 issue ";"No CA may issue certificates at all.
0 iodef "mailto:[email protected]"Where a CA should report a request that broke the policy.

How to check who may issue

  1. Look up the name you want a certificate forEnter the exact name, for example www.example.com. If it has no CAA records, a CA moves up to example.com, and then to each parent name above it. Repeat the lookup on each parent name until you find records.
  2. Check that your CA is namedYour CA's documentation gives the value to use, such as letsencrypt.org, digicert.com, sectigo.com, globalsign.com or pki.goog. A managed certificate service may use several issuer names.
  3. Add or change records before you switch CAA renewal with a CA that is not listed will fail. Add the new CA first, then retire the old one.

How CAA is evaluated

  • Tree climbing. A CA looks for CAA records on the requested name, then its parent, and so on towards the root. It stops at the first name that has any. Records on example.com therefore cover every subdomain without its own set, and records on a subdomain override the parent's for that subdomain.
  • CNAMEs are followed. If the name is an alias, the CAA lookup goes to the target.
  • issue and issuewild. issue governs all certificates. If issuewild is present, it overrides issue for wildcard certificates only.
  • No records at all. Any CA may issue. Setting CAA is opt-in protection.
  • Flags. The flag value 128 (critical) tells a CA that does not understand a tag to refuse to issue. Plain 0 is used in almost all records.
  • iodef. An email address or URL for violation reports. CAs are not required to send them.

Common problems

  • Certificate issuance fails with a CAA error. Your CA is not listed, or the CAA lookup returned SERVFAIL. Many CAs refuse to issue when the DNS answer is broken, so check the nameservers.
  • Wildcard certificates fail but normal ones work. An issuewild record names a different CA, or only issue ";" is present.
  • You use two CAs. Add one issue record for each. Several CAA records at one name combine.
  • Your DNS host rejects the record. Some older panels cannot create the CAA record type (257). Use a provider that supports it, or delegate the name.
  • Quotes and syntax. The value is quoted, as in 0 issue "letsencrypt.org". Missing quotes, or extra parameters such as an account URI, can cause errors.
  • Managed certificates. Cloud and CDN services may use their own CA names, for example amazon.com and amazontrust.com. Read their documentation before you lock down CAA.

How the lookup works and the standards

LookupOwl asks for type CAA (code 257) at the exact name you enter. It does not climb to parent names for you, so an empty answer on a subdomain does not mean that any CA may issue. A CA would look at the parent domain next, and you should too. CAA is specified in RFC 8659, which replaces RFC 6844, and the CA/Browser Forum Baseline Requirements make checking mandatory. RFC 8657 adds account and validation-method parameters for ACME CAs. To check the certificate a site is actually serving, use the SSL certificate checker.

Shell
dig +short CAA example.com
dig example.com CAA +noall +answer

Questions people ask

What is a CAA record?

A CAA record is a DNS record that lists which certificate authorities may issue certificates for your domain. CAs must check it before they issue one. If the CA is not on your list, it has to refuse. It is a cheap extra safeguard against certificates being issued for your name by mistake.

Do I need a CAA record?

No, it is optional. Without one, any CA may issue a certificate for your domain. Adding one is a cheap hardening step, as long as you keep it up to date when you change CA or start using a service that gets certificates for you, such as a CDN.

Does CAA apply to subdomains?

Yes. A CA starts at the requested name and climbs to its parents until it finds records. A record on your root domain therefore covers every subdomain that has no CAA records of its own. A record on a subdomain overrides the parent's for that subdomain.

How do I block all certificate issuance?

Publish a single record, 0 issue ";", on the name. The empty value means that no CA is allowed to issue. It suits a parked domain, or a name that never needs a certificate. Remove it before you request one, or the request will fail.

What value do I use for Let's Encrypt?

Use letsencrypt.org, as in 0 issue "letsencrypt.org". Other CAs publish their own identifiers in their documentation, so copy the value from there. Wildcard certificates from Let's Encrypt are covered by issue unless you add an issuewild record that says otherwise.

Why did my renewal fail after I added CAA?

The CA that handles the renewal was probably not listed. Add its identifier as another issue record, and add an issuewild record if you use wildcard certificates. Also check that your DNS host answers CAA queries cleanly, because a broken answer can block issuance too.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dns_lookup. Please be kind to the rate limits.

curl
curl "https://lookupowl.com/api/v1/tools/dns-lookup?q=google.com"
MCP
claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt