{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

{{ badge.label }}{{ badge.value }}
Domain CAA RRset{{ routeRecordMarker }} Issuer{{ routeIssuerMarker }} IODEF
Enter one public hostname, such as example.com or www.example.com.
Choose the name class used by the certificate request.
Compare public resolver views after DNS changes or during propagation checks.
Keep this on for hosted services and vanity names; turn it off only to inspect the original label.
{{ followCnameEnabled ? 'Follow CNAME' : 'Original label only' }}
Use 1 to 10 candidate names. Six covers the default workflow.
names
FlagsTagValueAppliesInterpretationCopy
{{ row.flags }}{{ row.tag }}{{ row.value }}{{ row.applies }}{{ row.note }}
No CAA records were returned from the searched chain.
CheckStatusEvidence and next stepCopy
{{ row.label }}{{ row.status }}{{ row.note }}

The chart renderer is unavailable. The same status counts remain available in Validation findings.

StepHostnameOutcomeEvidenceCopy
{{ row.step }}{{ row.host }}{{ row.outcome }}{{ row.note }}
DANE TLSA Validation Report Validate DANE TLSA records across mail or direct TLS routes with DNSSEC evidence, record checks, and optional certificate digest comparison.
ACME DNS Challenge Readiness Check Check ACME DNS-01 readiness before retrying issuance with exact TXT matching, delegation-path validation, and public-resolver cache hints.
MTA-STS Validator Check an email domain's MTA-STS TXT and HTTPS policy, then review MX patterns and the policy-host certificate before enforcement.
DMARC Validation Report Validate a domain's DMARC policy and check syntax, alignment and external report receivers before making stricter mail enforcement changes.

Certification Authority Authorization (CAA) is a DNS policy that tells public certificate authorities which issuers a domain permits. It is checked before certificate issuance. It does not list certificates already issued, validate a live TLS certificate, or replace domain-control and other certificate-authority checks.

The controlling policy may be higher in the DNS tree than the certificate hostname. A check begins at the requested name, follows DNS aliases as required, and climbs toward parent names until it finds the first non-empty CAA resource record set (RRset). That first set is relevant; records higher up are not combined with it.

Property Purpose
issueAuthorises an issuer for ordinary hostnames and acts as the fallback for wildcard names when no issuewild property exists.
issuewildAuthorises wildcard issuance and, when present, takes precedence over every issue property for that wildcard request.
iodefPublishes an incident-reporting destination; it does not authorise issuance.

An empty issuer value requests no issuance for that certificate class, but CAA authorisations are additive. An empty issue row does not cancel another valid issue row in the same relevant set. The critical flag is a separate safeguard: a certificate authority must not ignore a critical property tag that it does not understand.

CAA is a current policy view. DNS caches, propagation, aliases, resolver choice, issuer-specific parameters, and changes made after a certificate was issued can all affect interpretation. A clean lookup supports troubleshooting and issuance planning, but it is not proof that a certificate order will succeed.

How to Use This Tool:

Check the exact name class from the certificate request, then compare the relevant record set with the intended issuer's current CAA identifier and policy.

  1. Enter one public Hostname. A pasted URL or email-style value is reduced to its hostname, and only the first non-blank line is checked.
  2. Choose Exact hostname or Wildcard request. This choice changes whether issue or issuewild controls issuer authorisation.
  3. Run Validate CAA policy. Leave Follow aliases on for ordinary checks; use the other public resolver after a DNS change when you need a second cache view.
  4. Read Lookup chain first to identify the effective RRset, then review Policy evidence and Validation findings for the selected certificate scope.

Interpreting Results:

CAA policy looks consistent means all five local checks are healthy for the returned records and selected scope. CAA has review notes means no attention finding was raised, but at least one condition deserves confirmation. CAA needs attention means at least one rule could block or misdirect issuance.

  • No effective RRset means CAA does not restrict issuance in this resolver view. It is not a failure by itself.
  • For a wildcard request, issuewild takes precedence when present; otherwise the policy falls back to issue.
  • Check the actual issuer-domain-name and any parameters against the intended certificate authority's current documentation. The finding count is not a weighted risk score.

Technical Details:

A CAA record contains an unsigned flags octet, a case-insensitive property tag, and a property value. The issuer-domain-name is the portion of an issue or issuewild value before the first semicolon; following parameters are issuer-defined constraints and need issuer-specific interpretation.

Lookup Core:

Stage Exact behavior
Normalise nameReduce the first non-blank input to a lower-case hostname without a trailing dot; reject names without at least two valid DNS labels.
Alias optionWhen enabled, query the selected public resolver for one CNAME answer and use a valid returned target as the starting name.
Parent searchQuery CAA at the starting name, then remove one leftmost label at a time. Stop at the first non-empty CAA RRset or after the selected 1 to 10 candidate names.
Evidence viewRecord the resolver, queried names, outcomes, returned records, and lookup time for each searched level.
No RRsetIf no searched name returns CAA, report no explicit policy within the bounded search.

Rule Core:

Finding Healthy Review or attention
Effective RRsetAt least one CAA record was found.No record set is a review note because CAA is not restricting issuance in that view.
Issuance authorisationAt least one applicable, syntactically valid issuer-domain-name exists.No applicable issuer rule is Review; applicable rows with no valid issuer-domain-name are Attention.
Wildcard precedenceAn exact-host request ignores issuewild; a wildcard request uses it when present.A wildcard fallback to issue is marked Review so the intended policy can be confirmed.
Critical propertiesNo unknown critical property is returned.Unknown noncritical or reserved tags are Review; an unknown property with the 128 bit set is Attention.
IODEF destinationEvery published destination begins with mailto:, http:, or https:.No destination is Review; another URI scheme is Attention.

The overall state follows ordered precedence: any Attention finding produces CAA needs attention; otherwise any Review finding produces CAA has review notes; only five Healthy findings produce CAA policy looks consistent. Empty and valid issuer rows remain additive, so issue ";" plus issue "pki.goog" still leaves one valid authorisation.

The recognised-property list includes the IANA CAA tags known to this report, including reserved and non-TLS properties. Recognition is not the same as support by the intended issuer. A critical tag must be checked against that issuer's current certificate policy or certification practice statement.

Accuracy and Privacy Notes:

The entered public hostname is sent to the selected public DNS resolver for CNAME and CAA queries. The report records a resolver-visible snapshot; caches and propagation can make Cloudflare DNS and Google Public DNS disagree temporarily.

  • The alias option follows one returned CNAME before the bounded parent search. Complex alias chains may need a separate standards-complete DNS check.
  • The report does not validate DNSSEC proofs or reproduce a certificate authority's complete issuance system.
  • Current CAA records must not be used as the relying-party test for an already issued certificate.

Worked Examples:

Wildcard policy falls back to issue

A wildcard check finds one issue "letsencrypt.org" record and no issuewild. The issuer is applicable, but wildcard precedence is marked Review because the fallback should be intentional.

Valid issuer beside a critical unknown tag

A relevant set contains issue ";", issue "pki.goog", and an unknown tag with flags value 128. The valid issuer remains additive, yet the critical unknown property makes the overall result Attention until issuer support is confirmed.

References: