CAA
Enter a domain above to run this check.
CAA
CHECK.
See which certificate authorities the CAA of the domain allows, including the one inherited from the zone, and a ready record for Let's Encrypt and Google.
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
WAITING
What the check verifies
Reads the CAA records, which say which certificate authorities may issue certificates for the domain.
Why it matters
Without CAA, any trusted authority can issue a certificate for your domain if it is fooled during validation. With CAA, requests to other authorities are refused.
What each result means
- OK
- There is a CAA record, on the name itself or inherited from the zone, and the check lists who may issue.
- INFO
- No CAA: any trusted certificate authority may issue certificates for the domain.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
List every authority that issues certificates for you, including the one your CDN uses, and a contact for notices (iodef). If Cloudflare is your DNS, it adds the CAA records of the authorities it uses on its own.
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issue "pki.goog"
example.com. CAA 0 iodef "mailto:security@example.com"Would rather have someone else do it? Bit Happens can fix this →
More checks in DNS and name servers
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →