CAA record lookup
See which certificate authorities are allowed to issue for a domain. We check the exact name and climb to its parents, the same way a CA does before issuing.
Related tools: DNS lookup · A record lookup · CNAME lookup · NS lookup · TXT record lookup · Reverse DNS lookup · DNS propagation checker · All free tools
The certificate authorities a domain permits
A CAA record names the certificate authorities allowed to issue certificates for a domain; any other CA must refuse. Before issuing, a CA looks for CAA records at the exact hostname and, finding none, walks up to each parent until it reaches the registered domain. This tool does the same walk against Cloudflare's 1.1.1.1 resolver and shows the records it found and the name they were found on, which is what decides whether your next renewal succeeds.
A CAA record that blocks your own CA is the quiet reason an automated renewal fails, and you find out when the old certificate expires. Upcheck re-checks every certificate twice a day and warns your team weeks before expiry.
Three steps, no signup
- 01
Enter a hostname
The exact name you would request a certificate for, such as api.example.com.
- 02
We check the name, then its parents
If the exact name has no CAA records, the lookup climbs to each parent up to the registered domain, as a CA would.
- 03
The permitted CAs come back
With the tag, flags, and value of every record, and a clear answer when no CAA records exist at all.
Frequently asked questions
What is a CAA record?
Certification Authority Authorization: a DNS record that lists which certificate authorities may issue certificates for a domain. Every publicly trusted CA is required to check CAA before issuing and to refuse if it isn't listed. A domain with no CAA records anywhere in its hierarchy permits every CA, which is the default for most of the internet.
Why did the lookup show a record from a parent domain?
Because that is how CAs read CAA. If api.example.com has no CAA records, a CA checks example.com next and applies whatever it finds there. The tool climbs the same way and tells you which name answered, so a record on the apex that you forgot about doesn't surprise you at renewal time.
What should a CAA record for Let's Encrypt look like?
0 issue "letsencrypt.org". Add a second record with issuewild if you also want wildcard certificates from them, and a 0 iodef "mailto:security@example.com" record if you want to hear about refused requests. Each CA publishes the domain name to use in its CAA documentation; the value has to match exactly.
My certificate renewal fails with a CAA error. What now?
Run this lookup on the exact hostname in the failing request. The record that came back, at whatever name it was found, is what blocked the CA. Either add the CA you use to the issue (or issuewild) records at that name, or publish a CAA record on the specific hostname to override the parent. Then retry; CAA answers are cached only briefly, so the change is picked up quickly.
Is this CAA lookup free?
Yes. No account, no limit on lookups by hand; scripted use is rate limited. The paid product covers the other side of the problem: Upcheck re-checks every certificate you monitor twice a day and alerts your team before one expires or fails validation.
CAA decides who may issue. Monitoring makes sure someone did.
Add your hostnames to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook well before a certificate lapses.