Check which Certificate Authorities are permitted to issue SSL/TLS certificates for a domain.
Enter a domain to check which Certificate Authorities are permitted to issue its SSL certs
CAA (Certificate Authority Authorization) records control which Certificate Authorities may issue SSL/TLS certificates for a domain. Without them, any trusted CA can issue a certificate - CAA records close that gap and reduce the risk of unauthorized certificate issuance.
The issue tag allows a CA to issue standard certificates. The issuewild tag covers wildcard certificates. The iodef tag is an email or webhook URL where CAs send violation reports. Using ; as the value explicitly blocks all issuance for that type.
If no CAA records exist on the queried domain, CAs walk up the DNS tree and check parent domains. This tool does the same - when a subdomain has no records, the parent domain's policy is shown instead.
Sent to our server: Domain. We look it up in DNS. Part of this work runs on our own server. To answer a repeated check fast, we have to keep answers for 5 minutes; then they are deleted. Also added to the page link, so you can share the result: Domain.