CAA Record

A CAA record checker does more than confirm whether a record exists. It tells you which CAs are explicitly authorized, whether wildcard certificates are separately controlled, and whether violation reporting is configured. Missing any of these three means your SSL certificate issuance is either uncontrolled, unmonitored, or both.

Running a CAA record lookup on a domain you manage confirms your current configuration matches your intent. Running one on a vendor or client domain confirms their certificate issuance is locked down. The check takes seconds and the gap it surfaces could take weeks to exploit if left unaddressed.

The CAA check above queries your authoritative nameservers directly and returns live data. Missing records are flagged. Unauthorized CAs are identified. caa certificate configuration gaps between nameservers are surfaced, which is one of the less visible but most dangerous misconfigurations to miss in a client audit.

What are CAA Records?

A CAA record is a DNS record type that controls which Certificate Authorities are permitted to issue SSL and TLS certificates for your domain. Use the CAA checker above to see exactly which CAs are currently authorized and whether your configuration is complete.

Why CAA Records Matter

Since September 2017, all Certificate Authorities are required to check CAA records before issuing certificates. A domain without them is an open target. Specifically, missing CAA records expose your domain to:

• Unauthorized certificate issuance by rogue or compromised CAs
• Man-in-the-middle attacks using fraudulent certificates
• Phishing attacks that rely on improperly issued SSL certificates
• Domain hijacking attempts through certificate manipulation

How CAA Records Work

CAA records use three main property tags:

• issue - Specifies which CAs can issue certificates for your domain
• issuewild - Specifies which CAs can issue wildcard certificates (*.example.com)
• iodef - Defines where violation reports should be sent (email or URL)

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild "letsencrypt.org"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

Running A Validation

How To Check CAA Records

To run a CAA record check on any domain, enter it in the validator above and click Validate CAA. The tool queries your nameservers, retrieves all published CAA records, and returns a full configuration report. No DNS access is required and nothing changes on your domain by running the check.

If you manage domains on behalf of clients, as most MSPs do, checking CAA records during onboarding and after any certificate or registrar change is standard practice. A CAA record check takes seconds and confirms that the previous administrator did not leave unauthorized CAs on the record, which is one of the more common and easily missed security gaps in inherited domain management.