CAA Record Checker

Paste a hostname. This resolves the CAA record set that actually governs certificate issuance for it — walking up your DNS tree per RFC 8659 to the first ancestor domain that publishes one, the same way a real certificate authority does, rather than stopping at the exact name you typed. See why a CAA record blocks issuance for the full mechanism and the fixes. This tool never contacts the hostname itself — only Cloudflare's public DNS resolver, reading records the domain owner already published.

Run the check

Enter a hostname, then click Check.

Prefer a CLI, or want to gate a deploy on this?

The browser page and the CLI share the same lookup and analysis code, and both talk only to Cloudflare's public resolver, so there is no CORS wall here the way there is for tools that must also reach the target site itself. 

node check.mjs app.staging.example.com --ca letsencrypt.org --json

Get check.mjs, lookup.mjs, parse.mjs, and analyze.mjs from the repo — exit code 1 on a malformed record, a critical unrecognized tag, or (with --ca) a blocked CA; exit code 2 if the lookup itself could not complete. Wire it into deploy verification or a recurring DNS-zone-audit job.

Common questions

What is a CAA record, and why would it block my certificate?

A CAA (Certification Authority Authorization) DNS record names which certificate authorities are allowed to issue TLS certificates for your domain. If it names one CA and you (or your hosting provider) try to get a certificate from a different one, that CA is required to refuse — this is one of the most common causes of a sudden, confusing certificate-renewal failure, especially after switching hosts or CDNs.

Why check the parent domain, not just the exact hostname?

RFC 8659 says a certificate authority does not stop at the exact name you're requesting a certificate for. If app.staging.example.com has no CAA records of its own, the CA checks staging.example.com, then example.com, and uses whichever ancestor domain has the first non-empty answer. A tool that queries only the exact name reports "no CAA record, any CA may issue" for a subdomain whose parent actually restricts issuance. See how this compares to a plain DNS lookup.

What does a critical, unrecognized property tag actually do?

RFC 8659 defines exactly three standard tags (issue, issuewild, iodef). A record can mark any tag — including a custom or misspelled one — as "critical", and a compliant CA that does not specifically implement that tag must then refuse to issue for the domain at all, regardless of any issue records also present. Since no public CA implements an arbitrary custom tag, a critical flag on one effectively blocks every CA until the record is fixed — and it is invisible in a plain record listing that doesn't apply this rule.

Does a clean report guarantee my certificate will issue?

No. This reports what your published CAA records authorize, computed the way RFC 8659 says a CA must compute it — it is evidence about your DNS configuration, not a determination that a given CA will actually issue. The CA may apply its own additional checks (domain validation, rate limits, account restrictions) on top of CAA authorization.

Is it safe to point this at a hostname?

This tool never sends any request to the hostname you name — it only queries Cloudflare's public DNS-over-HTTPS resolver, reading CAA and CNAME records the domain owner already published for anyone to see. Nothing is uploaded to our servers when run in the browser; every request goes straight from your browser to the DNS resolver.