CAA Record Checker
Check which certificate authorities are allowed to issue SSL/TLS certificates for a domain, the same way CAs check before issuing, and build the CAA records you need.
CAA Record Checker
How this lookup works. When you press Check CAA, your browser sends the question over encrypted DNS-over-HTTPS to Cloudflare's public resolver (1.1.1.1), or to Google Public DNS (8.8.8.8) if you choose it below. The request goes straight from your device to them. It doesn't pass through ToolFeather: we have no server in the path, so we never see or store the names you look up. Requests are sent without cookies or a referrer. Each resolver has its own privacy policy: Cloudflare · Google.
Results appear here.
Tick the certificate authorities you use. The records below update as you go.
Queries your browser sent (0)
These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.
Live lookup: your browser asks Cloudflare or Google DNS directly. Nothing passes through ToolFeather.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Enter a host name
The exact name the certificate will cover.
Check CAA
See which records apply and where they came from.
Read who may issue
Normal and wildcard certificates are shown separately.
Build records
Use the builder to allow just the CAs you use.
Before restricting CAs, check which ones your CDN or host uses for automatic certificates, or renewals will start failing.
Features
RFC 8659 tree climbing
Checks the name and each parent in turn, exactly as CAs do, and shows which set applies.
CA names
Turns CAA values like pki.goog or amazontrust.com into the CA's name, covering 30+ CAs.
Wildcards and reports
Explains issue vs issuewild, iodef and RFC 8657 parameters.
Failure checks
Catches SERVFAIL (CAs must refuse to issue), unknown critical tags and mistyped CA domains.
CAA builder
Tick your CAs and wildcard policy to get zone-file and dashboard-ready records.
About the CAA Record Checker
A CAA (Certification Authority Authorization) record lists the certificate authorities allowed to issue certificates for a domain. Since 2017 every public CA must check CAA before issuing, and must refuse if it isn't on the list. A CAA record doesn't make your site more secure for visitors. What it does is stop someone getting a certificate for your domain from a CA you don't use, through a mistake or a social-engineering trick.
CAs look for CAA by climbing the tree (RFC 8659). For shop.eu.example.com they check that name, then eu.example.com, then example.com, and use the first set they find. With no CAA anywhere, any CA may issue. This tool climbs the same way and shows each step. Watch out for SERVFAIL: if the CAA query fails, CAs must refuse to issue, which is a common cause of renewal failures on DNS servers that don't support CAA.
Three tags matter. issue names a CA allowed to issue (and, unless overridden, to issue wildcards too). issuewild controls wildcard certificates separately. iodef gives an address for reports. An empty value, issue ";", forbids issuance. RFC 8657 adds accounturi and validationmethods, which lock issuance to one ACME account or one validation method. The builder below the checker writes ready-to-paste records for the CAs you tick.