CAA Record Lookup — Free & Instant

About this tool. A CAA record names the certificate authorities allowed to issue for your domain. Without one, any public CA in the world may issue a certificate for you, and you will not hear about it. This lookup follows the same inheritance a CA follows, so it reports the record that actually governs the name you entered.

Ten signals decide whether your mail arrives. You just checked one.

CAA governs certificates. None of the records that decide whether a receiving server trusts your mail are in it, and those are the ones that quietly cost you delivery.

SPF, DKIM, DMARC, MX and blocklist status, graded A to F in one pass
Every problem written out in plain English, with the record to publish
Saved under Reports, so you can re-run it and see what changed
One domain watched against the blocklists daily

Run the full checkup free

No card, and nothing to cancel.

How to read your CAA records

CAA names the certificate authorities allowed to issue for your domain. With no record, any public CA in the world may issue a certificate for you and nobody has to tell you.
The records are inherited down the tree. A CA asked to issue for mail.example.com checks that name, then example.com, and obeys the first set it finds, which is why we walk up and tell you which name actually governs the answer.
issue covers ordinary certificates and issuewild covers wildcards. A domain that permits issuance but not wildcards publishes both, with issuewild set to a semicolon.
iodef is where a CA reports an attempt it refused. It is optional and most domains skip it, which means the refusal happens silently and you never learn somebody tried.

Common problems and how to fix them

Certificate issuance is failing

Read the permitted issuers below. A CAA record that names Let's Encrypt will refuse DigiCert, and the error a CA returns is rarely clear about why.

You want to add CAA but use several providers

List every authority you use, including the one behind your CDN or host, which is often not the one you think. Missing one breaks renewal at the worst possible moment, when the old certificate expires.

No CAA record at all

Nothing is broken. It is a hardening step: publishing one turns a mis-issued certificate from something you discover later into something refused at the source.

DNSSEC Check MX Lookup A Record AAAA Record Full email checkup

Common questions.

What is a CAA record?

A DNS record naming which certificate authorities may issue certificates for your domain. Every public CA is required to check it before issuing, and to refuse if it is not named.

Do I need a CAA record?

No, and most domains do not have one. It is a hardening measure rather than a requirement, and it matters most for domains where a fraudulent certificate would be valuable to somebody.

Where does the CAA record go?

On the domain itself, or on any name above it. Because CAA is inherited, a record on example.com governs mail.example.com unless that name publishes its own.

Will a CAA record break my existing certificate?

No. It only affects issuance and renewal, not certificates already issued. It will break the next renewal if the authority doing the renewing is not on the list.

Does CAA affect email?

Not directly. It governs certificates, which matter for the TLS your mail servers use in transit, but it is not one of the records that decides whether your mail is trusted.