DNSBuddy
CAA Checker

Check who can issue certificates for a domain

Look up CAA records across multiple resolvers and confirm which certificate authorities are authorized before you request or renew TLS certificates.

Look up CAA records
Enter a domain name to lookup CAA records

Enter the domain name you want to lookup Examples: , , ,

View full DNS lookup tool with advanced options →
What to check
CAA records use tags like issue, issuewild, and iodef.
An empty CAA answer usually means any public CA can issue for the domain. Published records restrict issuance to the listed CAs.
Before renewal
Verify the CA you use is present before ACME or managed certificate renewals run.
If wildcard certificates are used, check for issuewildas well as issue. Some providers require both.

Frequently asked questions

What is a CAA record?

A CAA (Certificate Authority Authorization) record specifies which Certificate Authorities are allowed to issue TLS certificates for a domain. It is published in DNS before you request certificates from ACME providers like Let's Encrypt.

What happens if a domain has no CAA records?

If no CAA records are published, any public CA may issue certificates for the domain under CA/Browser Forum rules. Adding CAA records restricts issuance to the CAs you explicitly allow.

Should I check issuewild for wildcard certificates?

Yes. The issue tag controls standard certificates; issuewild controls wildcard certificates. If you use wildcard TLS, verify both tags include your CA.

Read the full CAA record guide