# CAA Record Checker: Which CAs May Issue for Your Domain

> Look up a domain's CAA records, including inherited parent records, and see which CAs may issue normal and wildcard certificates.

Source: https://ssl.sh/tools/caa-checker/
Last updated: 2026-11-10

Look up a domain's CAA records and see which certificate authorities are allowed to issue certificates for it.

The CAA checker shows which certificate authorities may issue certificates for a domain. Enter a name such as `example.com` and press **Look up CAA**: the tool shows the CAA records that apply, where in the DNS tree they were found, and which CAs are allowed for normal and wildcard certificates.

## How to use it

1. Enter the exact name you want a certificate for, such as `shop.example.com`.
2. Press **Look up CAA**.
3. Read the summary: allowed CAs for normal certificates (`issue`), for wildcards (`issuewild`) and the `iodef` report address if one is set.

## How CAA lookup works

A CA looks up the CAA record set of the requested name. If there is none, it removes the leftmost label and tries again (`shop.example.com` → `example.com` → `com`), and uses the first record set it finds. That is why a record on the bare domain controls every subdomain that has no records of its own. If the whole tree has no CAA records, any CA may issue.

## Reading the records

- `0 issue "letsencrypt.org"`: Let's Encrypt may issue normal certificates.
- `0 issuewild ";"`: no CA may issue wildcard certificates.
- `0 iodef "mailto:security@example.com"`: where a CA may report a refused request.
- `0 issue ";"` alone: no CA may issue at all, which blocks renewals.

If renewals fail with a CAA error, see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). To write new records in BIND, Cloudflare, Alibaba Cloud or DNSPod format, use the [CAA generator](https://ssl.sh/tools/caa-generator/).


## FAQ

**My certificate renewal fails with a CAA error. What should I check?**

Look up the exact name being renewed, including subdomains. If any record set applies to it, the CA's identifier (for example letsencrypt.org) must appear in an issue record, or in issuewild for wildcard names. A CNAME on the name can also redirect the lookup to another zone.

**Do CAA records affect certificates that already exist?**

No. CAA is checked only at issuance time. Adding a restrictive record does not revoke or invalidate current certificates; it only blocks future issuance by other CAs.

**How long does a CAA change take to apply?**

CAs query DNS when they validate, so the change applies once resolvers see it, which can take up to the record's TTL. The Baseline Requirements also let a CA rely on a CAA lookup for up to 8 hours, or the record's TTL if that is longer.