CAA Record Checker

A CAA (Certification Authority Authorization) record is a DNS record that specifies which Certificate Authorities (CAs) are permitted to issue SSL certificates for your domain. Before issuing a certificate, CAs are required by the CA/Browser Forum to check for CAA records. If your domain has a CAA record listing only letsencrypt.org, no other CA can issue a certificate for your domain — providing protection against mis-issuance even if a CA is compromised or tricked.

Without a CAA record, any Certificate Authority can issue an SSL certificate for your domain. This is the default state for most domains. While most domains operate fine without CAA records, publishing one adds a meaningful security layer by restricting which CAs can issue for your domain. The risk without CAA is that a fraudulent certificate could be issued by a less rigorous CA, enabling man-in-the-middle attacks.

The issue tag authorises a CA to issue regular (non-wildcard) certificates for the domain. The issuewild tag authorises a CA to issue wildcard certificates (e.g. *.example.com). If you only have an issue record, wildcard certificate issuance falls back to the issue policy. To allow wildcard certs from a specific CA, add a separate issuewild record. To block all wildcard issuance, add issuewild with an empty value: example.com. CAA 0 issuewild "".

The iodef (Incident Object Description Exchange Format) tag in a CAA record specifies a URL where CAs should send violation reports if they are asked to issue a certificate that violates your CAA policy. You can specify a mailto: address (iodef "mailto:security@example.com") or an HTTPS endpoint. Not all CAs support iodef reporting, but it provides a useful audit trail. It does not block unauthorised issuance — it only reports the attempt.