CAA record checker
Check which certificate authorities may issue SSL certificates for a domain, and whether wildcards are limited. Reads public DNS only.
Related guides
CAA record explained
CAA records explained: limit who can issue your SSL certificatesA small DNS record that tells certificate authorities who is allowed to issue for a domain, with examples and the one mistake to avoid.
SSL certificate validity 47 days
SSL certificates are moving to 47 days: what MSPs should tell clientsThe CA/Browser Forum schedule, why it is happening, and why manual renewals stop being viable for client websites.
Guide
Domain and DNS security checklist for small businessesTwelve checks that keep a business's domain, website and email in the right hands, in the order an MSP should work through them.
How CAA checking works
The checker looks for CAA records on the domain and climbs to the registrable domain if none exist, the same way certificate authorities do. A subdomain's own records override the parent's. More on CAA records explained.
Frequently asked questions
What is a CAA record?
A CAA (Certification Authority Authorization) record is a DNS record that names the certificate authorities allowed to issue certificates for a domain. Authorities are expected to check it before they issue (RFC 8659).
What happens if a domain has no CAA record?
Any public certificate authority can issue a certificate for it. That is not a fault by itself, but a CAA record limits who can, so a request from an unexpected authority is refused.
Will a CAA record break certificate renewal?
It can, if the record does not name the authority that renews your certificate. Add the authority your host or automation uses before you publish the record.