Skip to content
ProbeDNS

CAA Record Lookup

A CAA record tells certificate authorities which of them may issue certificates for your domain. Since 2017 every public CA must check CAA before issuing and refuse if it is not listed. This lookup shows the issue, issuewild, and iodef policies a domain publishes — or confirms that none exist.

How CAA changes certificate issuance

CAA (RFC 8659) is a whitelist enforced by the CAs themselves. Publish no CAA record and every public CA may issue for your domain — that is the default, and it is not a misconfiguration. Publish one and the set narrows to exactly what you listed. The CA/Browser Forum has made the check mandatory since September 2017, so this is enforced in practice, not merely specified.

dig +noall +answer github.com CAA
github.com.	3600 IN CAA 0 issue "digicert.com"
github.com.	3600 IN CAA 0 issue "sectigo.com"
github.com.	3600 IN CAA 0 issue "globalsign.com"
github.com.	3600 IN CAA 0 issue "letsencrypt.org"
github.com.	3600 IN CAA 0 issuewild "digicert.com"
github.com.	3600 IN CAA 0 issuewild "sectigo.com"
github.com.	3600 IN CAA 0 issuewild "letsencrypt.org"

dig +noall +answer google.com CAA
google.com.	17222 IN CAA 0 issue "pki.goog"
Real CAA sets. GitHub authorises four CAs; Google authorises only its own.
PartExampleMeaning
Flags0The critical bit. 0 is normal. 128 means a CA that does not understand the tag must refuse to issue.
issue0 issue "letsencrypt.org"This CA may issue non-wildcard certificates for the domain.
issuewild0 issuewild "digicert.com"This CA may issue wildcard certificates. If absent, the issue tag governs wildcards too.
iodef0 iodef "mailto:[email protected]"Where a CA should report a policy violation. Optional and advisory.
issue ";"0 issue ";"A semicolon as the value forbids all issuance. Use deliberately — it blocks every CA.

The tree-climbing rule

CAA is the one record type that is effectively inherited, and the mechanism surprises people. When a CA checks shop.example.com, it queries that exact name first. If no CAA record exists, it strips a label and queries example.com, then continues upward until it finds a CAA record set or reaches the root. The first record set found wins outright — parent policies are not merged with child policies.

Read the full explanation of caa record lookup results ↓

The practical consequence: publishing a CAA record on a subdomain completely replaces the apex policy for that subdomain, not adds to it. If example.com authorises Let's Encrypt and DigiCert, and you add 0 issue "letsencrypt.org" at shop.example.com, DigiCert can no longer issue for shop.example.com. Subdomain records must list every CA that subdomain needs.

Wildcards are the classic CAA outage. A 0 issue "letsencrypt.org" record with no issuewild still permits Let's Encrypt to issue wildcards. But add 0 issuewild "digicert.com" and Let's Encrypt is now blocked from wildcards entirely, because issuewild overrides issue for wildcard requests. Renewals that worked for a year suddenly fail.

Choosing what to publish

  1. Inventory every certificate you currently hold, including ones issued by CDNs, load balancers, and hosting panels on your behalf. The SSL certificate checker shows the issuer of the live certificate for each hostname.
  2. List every one of those issuers in issue tags. Missing one breaks renewal months later, when nobody connects the outage to a DNS change.
  3. Add issuewild only when you actually want to restrict wildcards differently. Otherwise leave it out and let issue govern both.
  4. Add an iodef address — mailto: or https:// — so you learn when someone attempts unauthorised issuance.
  5. Keep the TTL moderate (3600). CAs check at issuance time, so a long TTL delays legitimate policy changes without adding security.
  6. Re-check here after publishing, and again the first time each certificate renews.

Note which CA names to use. The value is an identifier the CA publishes, not a hostname you choose: letsencrypt.org, digicert.com, sectigo.com, globalsign.com, pki.goog, amazon.com and amazontrust.com for ACM, ssl.com. Get it wrong and the CA simply does not match itself and refuses.

Common failures and fixes

  • "CAA record prevents issuance" from your ACME client. The CA you are using is not in the set. Check the exact name it expects — for ACM it is amazon.com, amazontrust.com, awstrust.com, and amazonaws.com, and omitting any of them can break renewals.
  • Wildcard issuance fails while single-name certificates work. An issuewild record exists that excludes your CA. Add it, or remove the issuewild records entirely.
  • Certificates fail only for one subdomain. That subdomain has its own CAA set overriding the apex. Remember: nearest record wins, nothing is merged.
  • A CDN cannot provision a certificate for your domain. Many CDNs issue on your behalf through their own CA. Authorise it, or the provisioning silently retries forever.
  • Record present but ignored. Check the tag spelling — issuewild has no space or hyphen — and that the value is quoted. Some panels expect the three parts in separate fields; putting 0 issue "letsencrypt.org" into a single value field then produces a malformed record.

Checking CAA from the command line

# The domain's own CAA records
dig +short example.com CAA

# Walk up the tree exactly as a CA does
for n in shop.example.com example.com com; do
  echo -n "$n: "; dig +short "$n" CAA | tr '\n' ' '; echo
done

# Confirm which CA issued the certificate you are actually serving
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -issuer -dates
The openssl command names your current issuer — that CA must appear in your CAA set before the next renewal.
CAA does not affect certificates already issued, and it does not affect browsers. It is checked only at issuance time, by the CA. Adding a record never breaks a working site immediately — it breaks the next renewal, which is why the failure often arrives 60 or 90 days later.

Frequently asked questions

Do I need a CAA record?
It is optional. Without one, any public CA may issue for your domain — the situation almost every domain is in. With one, you reduce the risk of mis-issuance to the CAs you actually use. It is a low-effort, meaningful hardening step, provided you list every issuer you rely on.
Will adding a CAA record break my existing certificates?
No. CAA is evaluated only when a certificate is issued or renewed, and never by browsers. Existing certificates keep working until they expire. The risk is that a renewal fails months later because the renewing CA was omitted, so verify the issuer of every live certificate before publishing.
What is the difference between issue and issuewild?
issue authorises certificates for specific names; issuewild authorises wildcard certificates such as *.example.com. If no issuewild record exists, issue governs wildcards as well. As soon as any issuewild record exists, it takes over for wildcard requests and issue no longer applies to them.
Does a CAA record on my domain cover subdomains?
Yes, by the tree-climbing rule: a CA checking a subdomain with no CAA record of its own walks up until it finds one. But a CAA set on a subdomain completely replaces the parent policy for that subdomain — the two are never merged.
How do I block all certificate issuance for a domain?
Publish 0 issue ";". A lone semicolon means no CA is authorised. This is appropriate for a parked domain or one that will never serve TLS. Remember to remove it before you ever need a certificate, and to add 0 issuewild ";" if you want to block wildcards specifically.
Why does my ACME client say CAA prevents issuance?
The CA it is talking to is not listed, or an issuewild record excludes it for a wildcard request. Run the lookup on the exact name being validated — including any subdomain — and confirm the CA's published identifier appears. Case does not matter; spelling does.
What does the iodef tag do?
It gives CAs an address — mailto: or an https:// endpoint — to report policy violations to when a request is refused because of your CAA record. It is advisory: CAs are not required to send reports, and many do not. It costs nothing to publish and occasionally gives you early warning of an unauthorised issuance attempt.

Related guides

Fix an Incomplete SSL Certificate Chain

Why curl works but browsers fail, and how to install the intermediate.