Skip to content
Control Plane Labs
Search

CAA Record Checker

Find the CAA record a CA will use for your domain, then check it against every CA that issued for the name in Certificate Transparency logs.

Privacy: The domain you type goes to /api/caa-check on this site. The edge function asks Cloudflare's public DNS-over-HTTPS resolver for CAA records on the name and its parents, and asks CertIndex for certificates logged for the exact name. It sees your IP address only for rate limiting. Nothing is stored, and both data sources are public.

CAA Record Checker

Your workspace Expand for more room

What it does

Type a domain. The checker finds the CAA record set a certificate authority would use for that name, climbing to parent names the way RFC 8659 requires. It parses every issue, issuewild and iodef value, including the RFC 8657 accounturi and validationmethods parameters. Then it compares the record with the CAs that actually issued for the name in Certificate Transparency over the last 13 months.

The comparison is the part a plain DNS lookup cannot give you:

  • Renewal risk. A CA that issued your current certificate but is missing from the record now will fail at the next renewal.
  • Unused allowances. CAs your record allows but that never issued for the name.
  • Partial account binding. One bound value next to an unbound one protects nothing, because CAA values are additive.
  • Wildcards. Wildcard certificates checked against issuewild, plus a suggestion to forbid wildcards when none were issued.

Each run ends with a suggested record set built from the CAs seen in CT, ready to edit and paste into your zone.

How it works

The query runs at /api/caa-check, an edge function limited to thirty checks an hour. It asks Cloudflare’s public DNS-over-HTTPS resolver for CAA on the name and each parent in turn, stopping at the first non-empty set. In parallel it reads one page of certificates for the exact name from CertIndex, an index of the public CT logs, and counts final certificates (not precertificates) by issuer. Each upstream has its own deadline. If the CT index is slow, you still get the full CAA analysis with a note that the history check was skipped.

When to reach for it

  • Before you change DNS or hosting providers, to see which CAs your record must keep allowing.
  • After a renewal fails with a CAA error.
  • When you add accounturi, to confirm no unbound value is left behind.
  • As part of a periodic certificate review, next to the CT lookup and the TLS inspector.

The CAA record reference covers record syntax, and our CAA survey of 60 developer sites shows what these findings look like in practice.

Frequently asked questions

Why does the tool show a parent domain's record?+
A CA looks for CAA on the exact name first, then climbs one label at a time toward the TLD and uses the first non-empty set it finds (RFC 8659). If www.example.com has no CAA record, the record on example.com governs it. The tool lists every name it queried.
A CA shows as 'issued here but not allowed now'. Is that a mis-issuance?+
Usually not. CAA is checked only at issuance, so the most common cause is a record that changed after the certificate was issued. It still matters: the next renewal from that CA will fail unless you add it back or move renewals to an allowed CA.
What does 'account binding is partial' mean?+
CAA values are additive. If one value for a CA carries an accounturi parameter and another value for the same or a different CA does not, an attacker simply uses the unbound one. Binding only protects you when every allowed value is bound.
Where do I find my ACME account URL for accounturi?+
Your ACME client stores it. Certbot keeps it in the account directory under /etc/letsencrypt/accounts, and most clients print it when they register. For Let's Encrypt it looks like https://acme-v02.api.letsencrypt.org/acme/acct/ followed by a number.
Why are some CAs listed as unmapped?+
The tool maps issuer organizations to the CAA identifiers that the major public CAs document. For other CAs, look up the identifier in section 4.2.1 of that CA's CP/CPS before you add it to your record.
Does a missing CAA record mean my domain is insecure?+
No. It means any publicly trusted CA may issue for the name, and you rely on Certificate Transparency monitoring to catch a bad certificate after the fact. CAA narrows who can issue; CT shows what was issued. Use both.

Related tools

Certificate Transparency Lookup

Look up indexed certificate observations for a domain, inspect coverage limits, discover names from SANs, and export the returned records as CSV.

TLS Certificate Inspector

Fetch a live certificate chain by hostname or paste a PEM. Decodes subject, SANs, validity, key and signature algorithms, fingerprints and embedded SCTs.

DNS Lookup

Query A, AAAA, CNAME, MX, TXT, NS, SOA, CAA and SRV records over DoH, with TTLs, the DNSSEC AD bit, and SPF, DMARC, MX and CAA read back in plain English.

→ Read the full guide:How this tool actually works

Data from DNS over HTTPS (Cloudflare) and Certificate Transparency logs via CertIndex.