CAA Checker & Generator
Check which certificate authorities may issue for a domain, or generate correct CAA records.
About the CAA Checker & Generator
A CAA record is a DNS entry that names which certificate authorities may issue certificates for your domain. Before issuing, every public CA is required to look it up and refuse if it is not listed. Without one, any of the dozens of public CAs can issue for your domain, so a single mistake or compromise at any of them becomes your problem.
The checker finds the records that govern a name the way a CA does. If the name has no CAA records, it checks each parent domain in turn, so a record on example.com protects mail.example.com. It then explains what it found: which CAs are allowed, whether wildcard certificates are handled separately, whether a violation reporting address is set, and any record that would cause trouble, such as a critical flag on a tag no CA understands.
The Generate tab builds the records for you from a list of common CAs, or from an identifier you supply, and gives you ready to paste zone file lines. Check with your CA for the exact identifier it uses, and add one for every CA you rely on before publishing, or renewals will fail. Once the records are live, confirm the certificate itself with the SSL Checker, and if a chain looks wrong, try the SSL Chain Fixer.
Reach the developers and engineers who use these tools every day.
Frequently asked questions
Will adding a CAA record break my existing certificates?
No. CAA is checked only at the moment a certificate is issued or renewed, so existing certificates keep working. The risk is at renewal: if your CA is not listed, the renewal is refused. List every CA you use first.
What is the difference between issue and issuewild?
The issue tag controls ordinary certificates, and issuewild controls wildcard certificates. If you publish no issuewild record, wildcards follow the issue tag. Publishing issuewild with a semicolon blocks wildcards entirely.
Why did my subdomain show records from a different name?
CAs look at the name being certified first and then climb to each parent until they find records. A subdomain with no CAA of its own inherits its parent, and the report says where the records were found.
What does an issue record with just a semicolon mean?
It tells every CA not to issue certificates for the domain. Use it for domains that should never have a certificate, such as parked names, and remember to replace it before you need one.
What is the iodef tag for?
It gives a CA an address to report a request it refused because of your policy. It is optional, but it is how you learn that someone tried to get a certificate from a CA you did not authorise.