CAA record lookup
Shows which certificate authorities are allowed to issue SSL certificates for this domain. No CAA record means no restriction: any authority may issue.
Need another tool?
Pick one of the 25 belowOutput
What the CAA record lookup shows
A CAA record lookup shows which certificate authorities a domain allows to issue SSL certificates for it. The query goes to Cloudflare's 1.1.1.1 from the IPVIEW server over the toolkit's own DNS engine. Every public authority must check CAA before issuing, so these records are read by Let's Encrypt, DigiCert and the rest at the moment of issuance, and an authority not named must refuse.
No CAA record means no restriction: any authority may issue, which is the state of most domains. Authorities look at the exact name first and then walk up through the parents, so a record at example.com governs shop.example.com unless that name publishes its own. A CNAME is followed on the way.
How to read the result
Each row shows a tag and a value, with the flag noted beside the value when it is not zero. issue names an authority allowed to issue ordinary certificates, by the domain it has declared for the purpose, such as letsencrypt.org; issuewild does the same for wildcards; iodef gives a mailto or https address for reporting violation attempts. The value ; alone with issue means nobody may issue. A flag of 128 marks the record critical: an authority that does not understand the tag must refuse. The TTL here is the time left on 1.1.1.1's cached copy and can be lower than the TTL set in the zone; the Full report does not grade the TTL of CAA records.
The common failure is a renewal that suddenly fails with a CAA error: the authority's identifier is misspelt, the record names a previous authority only, or a wildcard is requested with only issue present. An empty answer reads: No CAA record, no restriction; The name does not exist at all, NXDOMAIN; The query failed, nothing follows, and an authority that cannot get an answer is itself allowed to refuse.
When it is useful
Certificate issuance or renewal fails and the error mentions CAA: read the records here and compare the identifier with the one the authority documents. Then use the SSL certificate check on the live site to see which authority issued the current certificate; that is the one the record has to name.
Before publishing a CAA record for the first time, to see what is already there, looking up the apex and each parent name in turn, since a record higher up applies to every subdomain that lacks one. After publishing, the TTL says how long an authority may still see the old answer.
Common questions
What is a CAA record?
A DNS record naming the certificate authorities allowed to issue for a domain. Authorities must check it before issuing. It limits who can issue; it does not make the certificates themselves any stronger.
Do I need a CAA record?
No. Without one any authority may issue, which is the default for most domains. It is a control for domains that want issuance limited to the authorities they actually use.
Why did my certificate renewal fail with a CAA error?
The record does not name the authority that tried to issue, names it under the wrong identifier, or allows issue but not issuewild for a wildcard. Compare the value here with the identifier the authority publishes.
Does a CAA record on the domain cover subdomains?
Yes, unless the subdomain publishes its own. Authorities check the exact name first and then its parents, and the first CAA set they find applies.
Limits. The DNS, WHOIS and SSL tools allow up to 20 requests a minute per IP address. Ping, traceroute and MTR send real packets to their target, so they allow 6 a minute.
The port check runs only against your own IP address. That is deliberate: the question people actually have, "is this port reachable from outside?", is answered by it, while this server cannot be used to scan anyone else's network.
Private and reserved addresses. These are refused by the tools that really connect to their target: the SSL check, ping, traceroute, MTR and the port check. The DNS tools have no such limit, because they only ask a nameserver a question and never connect to the address itself.