AltF DomainOps

CAA record check

A CAA record lists the certificate authorities allowed to issue certificates for a domain. Authorities must check it before issuing, so it blocks mis-issuance by everyone else. DomainOps reads the issue, issuewild and iodef tags and explains what they allow.

  • Free, no sign-up
  • Real DNS, RDAP and TLS data
  • Raw records shown
  • No affiliate links
Check a domain

Reading CAA tags

  • issue: authorities allowed to issue normal certificates, such as letsencrypt.org or digicert.com.
  • issuewild: authorities allowed to issue wildcard certificates. If absent, issue applies to wildcards too.
  • iodef: where an authority should report a refused request (mailto: or https:).
  • issue ";" means no authority may issue at all.

If a certificate will not issue

Your authority may be missing from the list. Cloudflare, AWS and Google-managed certificates use their own authorities (for example pki.goog or amazon.com), so add those too. CAA is inherited: if a subdomain has none, the parent's records apply.

CAA record check: questions and answers

Do I need a CAA record?

It is optional, but recommended. Without one, any public certificate authority may issue for your domain.

How do I write a CAA record?

Use the CAA mode of the DNS record generator on AltFTool, then add the records at your DNS host and check them here.

Focused checks and guides

Checks

Full domain health checkAll nine tools, the record glossary and how each check works.DNS lookupFree DNS lookup for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY and HTTPS records, with TTLs, DNSSEC status and what each record means.MX lookupFree MX record lookup: see a domain's mail servers in priority order, which email provider runs them, and whether SPF and DMARC are set.NS lookupFree nameserver lookup: see which nameservers answer for a domain, who the DNS host is, the SOA serial, and whether the zone is DNSSEC-signed.TXT record lookupFree TXT record lookup that labels each record: SPF, Google and Microsoft verification, Meta, Apple, Stripe and 25 more services, plus DMARC and DKIM.SSL certificate checkFree live SSL checker: connect to any site and see its certificate issuer, expiry date and days left, covered hostnames, chain trust and TLS version.Domain expiry checkCheck when a domain expires from the registry's own RDAP data: expiry date, days left, registrar, transfer lock and status codes in plain English.Reverse DNS lookupFree reverse DNS lookup for IPv4 and IPv6: find the PTR hostname of an IP address and the network owner from the regional internet registry.DNSSEC checkCheck whether a domain uses DNSSEC: DS record at the registry, DNSKEY in the zone and whether public resolvers validate the answers.

Guides

Domain launch checklistA 20-point checklist to launch a new domain: DNS records, www, HTTPS, email authentication, DNSSEC, CAA, registrar lock, with a free check for each step.Website migration DNS checklistMove a website or DNS to a new host without downtime: lower TTLs, copy records, switch nameservers, watch resolvers, handle DNSSEC and email.Email domain setup guideSet up email for your domain the right way: MX records, one SPF record under 10 lookups, DKIM keys, a DMARC rollout plan, MTA-STS and BIMI.

25 more free domain and DNS tools

Single-purpose AltFTool tools for one job each, grouped by what you are trying to do.

Lookups

One question, one answer.

Write records

Generate correct records before you paste them into your DNS host.

Certificates and HTTPS

Go deeper than the live certificate check.

See all 25 tools

AltFTool does not store the domains or addresses you check. DNS lookups in the DNS, compare, email and IP tools run from your browser; registration, report and certificate checks pass through AltFTool's server and keep nothing.