CAA Record Lookup — Which CAs May Issue Certificates

What is a CAA record?

A CAA record states which certificate authorities are allowed to issue certificates for a domain. Every public CA is required to check it before issuing, so it is a cheap way to stop a certificate being issued for your domain by a CA you never intended to use — including by someone who has compromised a weaker validation path.

Fields in a CAA record

Field	Meaning
Flags	A critical bit. `0` is normal; `128` means a CA that does not understand the tag must refuse to issue.
Tag	`issue` (normal certificates), `issuewild` (wildcards), or `iodef` (where to report violations).
Value	The CA’s identifying domain, such as `letsencrypt.org` — or `";"` to forbid issuance entirely.

How to read the results

Each row is one policy statement. Several rows together form the full policy: list every CA you actually use, or issuance from the others will fail. An empty result means no policy is published, so any CA may issue — valid, but a missed opportunity.

Rules worth knowing

If a domain has no CAA record, resolvers climb to the parent domain and use the first policy they find. Only if nothing is found anywhere is issuance unrestricted.
Once you publish any CAA record, every CA not listed is forbidden. Listing too few is the usual way people lock themselves out of renewals.
issuewild overrides issue for wildcard certificates. Without an issuewild tag, the issue policy applies to wildcards too.
A value of ";" forbids issuance outright — useful on a domain that should never have a certificate.
CAA is checked at issuance time only. It has no effect on certificates already issued, and browsers never look at it.

Common problems

What you see	Usual cause
Certificate issuance suddenly fails	A CAA policy exists that does not list the CA you are using. Add an `issue` row for it.
Wildcard issuance fails but normal certificates work	An `issuewild` tag is present and does not include that CA.
No records	No policy at this name. Check the parent domain — resolvers inherit upward — and consider publishing one.
Policy has no effect	CAA constrains issuance, not validation. An already-issued certificate stays valid until it expires.

Look up another record type

Each record type has its own page with the same explanation of its fields, or use the full DNS Lookup to query every common type at once.

A record AAAA record MX record TXT record NS record CNAME record SOA record SRV record

Most often looked up alongside CAA: TXT Record Lookup , SOA Record Lookup , A Record Lookup .

Data source: Public DNS-over-HTTPS resolvers. Queries go to the selected public resolver; results reflect that resolver’s cache. Learn about our data sources →

Frequently asked questions

What does a CAA record do?

It tells certificate authorities which of them are allowed to issue certificates for your domain. CAs are required by the CA/Browser Forum baseline requirements to check it before issuing.

Do I need a CAA record?

It is optional, but it is one of the few DNS records that meaningfully reduces risk for very little effort. Publish one listing the CAs you actually use.

Why did my certificate renewal fail after adding CAA?

Almost always because the CA doing the renewal is not in the list. A CAA record is a strict allow-list: anything unlisted is forbidden.

Does CAA apply to subdomains?

Yes. When a name has no CAA record of its own, the CA climbs to the parent domain, so a policy at the apex covers everything beneath it unless a subdomain publishes its own.