Are Certificate Authorities required to check CAA records?

Yes. As mandated by the CA/Browser Forum, all public Certificate Authorities must check CAA records before issuing any SSL/TLS certificate.

How do I allow Let's Encrypt via CAA?

Add a CAA record with flag 0, tag 'issue', and value 'letsencrypt.org' (e.g., example.com. CAA 0 issue "letsencrypt.org").

How do I check if my domain has CAA records?

Check using our DNS Lookup tool with the CAA filter or run 'dig CAA example.com' from terminal.

Home/DNS Lookup/CAA Record

PTR SRV

DNS Resource Record Type

CAA Record: Certification Authority Authorization

Specifies which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for a domain.

Record Type

CAA

Query Protocol

DNS Port 53

Standard / RFC

RFC 8659

Recommended TTL

3600 seconds

Query Live CAA Records

Query any domain name to inspect authoritative CAA records, response latency, and TTL values.

Loading DNS lookup tool...

BIND Zone File Syntax

Standard BIND representation of this record in authoritative master zone files:

example.com. 3600 IN CAA 0 issue "letsencrypt.org"

Recommended TTL: 3600 seconds (1 hour).

Common Configuration Pitfalls

Configuring a CAA record that permits only Let's Encrypt, causing certificate renewal failure if you switch to a cloud CDN providing DigiCert certificates.
Failing to include 'issuewild' directives when issuing wildcard SSL certificates (*.example.com).

How the CAA Record Operates in DNS Resolution

The CAA (Certification Authority Authorization) record allows domain owners to specify exactly which Certificate Authorities (such as Let's Encrypt, DigiCert, or Sectigo) are authorized to issue SSL/TLS certificates for their domain. RFC 8659 requires all public CAs to check CAA records before issuing certificates, preventing rogue or unauthorized certificate generation.