See which certificate authorities are allowed to issue certificates for your domain, straight from live DNS. This checker reads the CAA records at your domain and at its parent domains, then explains them in plain words.
Loading tool…
Lower stack cost. Back in the inbox. Built to send at any scale.
We rebuild it properly: secondary domains, inboxes, SPF, DKIM and DMARC set to enforcement, warmup and safe sending limits, blacklist monitoring on top. Send-ready in about 17 days. No campaigns, no copy, no lead lists. Infrastructure only.
Almost a decade building cold outreach infrastructure, including his own sending and verification stack built from scratch. 20+ B2B clients at companies worth $10M and above, all in tier one countries.
Free · Written plan + fixed price · No sales call required
A CAA record is a DNS record that names the certificate authorities allowed to issue SSL and TLS certificates for a domain. CAA stands for Certification Authority Authorization. Before issuing a certificate, a certificate authority checks the CAA records for the domain. If that authority is not named in an issue or issuewild record, it must refuse to issue. That way an authority you never use cannot issue a certificate for your domain by mistake, and an attacker cannot shop around for the weakest authority.
Every CAA record has three parts: a flags number, a tag and a value, written in DNS like this: 0 issue "letsencrypt.org"
The flags number is 0 on nearly every record. A flags value with 128 in it marks the tag as critical, which tells an authority that does not understand the tag to refuse the certificate.
CAA is checked up the domain tree, not only at the exact name. If a host has no CAA record of its own, the authority asking looks at the parent domain next, then the parent above that, and stops at the first level that has CAA records. Records set at example.com therefore cover shop.example.com and mail.example.com, unless a subdomain publishes its own records, and the closer records win. This checker follows the same rule. It checks the domain you enter first, then each parent in turn, and it tells you which level the records came from.
Add CAA records in the DNS control panel for your domain, at the root of the domain. The host is usually written as @ or left blank, the type is CAA and the TTL can stay at the default. A common setup allows one certificate authority and adds a report address:
0 issue "letsencrypt.org"
0 iodef "mailto:security@example.com"
Swap letsencrypt.org for the authority your certificate provider uses. If you get certificates from two authorities, add one issue line for each. Add an issuewild line only for an authority that should also issue wildcard certificates. After you save, wait for DNS to update, then run this checker again to confirm the records are live.
CAA has nothing to do with email sending or email deliverability. It does not change SPF, DKIM or DMARC, it does not stop mail spoofing, and it does not affect whether your email reaches the inbox. CAA is a website certificate control, and that is all it is. For the email side of a domain, use the Domain Health Checker and the DMARC Checker, and keep a long SPF record inside the lookup limit with the SPF Flattener.
It is a DNS record that lists the certificate authorities allowed to issue SSL and TLS certificates for a domain. Any authority that is not listed must refuse to issue a certificate for that domain.
You do not strictly need one, because certificates work fine without it. It is still worth adding. It takes a few minutes, it costs nothing, and it closes a real hole: without CAA, any of the hundreds of trusted authorities can issue a certificate for your domain.
Nothing breaks. With no CAA record at the domain or any parent, any trusted certificate authority may issue certificates for your domain. That is the default for most domains. It is common and it is not an error, but adding CAA is a cheap control.
The iodef tag gives certificate authorities a way to report requests that your CAA policy blocks, or other policy problems. The value is usually an email address in the form mailto:you@example.com. Reports are rare, but the address should be a mailbox someone reads.
The issuewild tag names the authorities that may issue wildcard certificates, the certificates that cover all subdomains at one level. If you publish issuewild records, they decide who may issue wildcards. If you publish issue records but no issuewild records, the issue list also covers wildcards.
Yes, it can, so take care. If your certificate authority is not listed in your issue records, it must refuse to issue or renew your certificate, and your site can lose its working certificate when the old one expires. Before you publish CAA, confirm which authority issues your certificates, list it, and add any backup authority you use.
In the DNS settings for your domain, with your DNS host or domain registrar. Add it as a CAA type record at the root host, usually shown as @. Most DNS panels have CAA in the record type list.
No. CAA controls website certificates only. It has no effect on sending email, receiving email, spam scores or inbox placement. Email authentication is handled by SPF, DKIM and DMARC instead.
Yes. This checker is free and needs no sign up. Enter a domain and it reads the live CAA records from public DNS.
It covers what is broken, what we would build, the timeline, and one fixed price. Want it walked through instead? Book a 15 minute plan walkthrough.
Or just reply to the plan email. Either works.
