CAA record

Declares which certificate authorities are allowed to issue certificates for the domain. Authorities are required to check it.

What one looks like

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Things worth knowing

  • With no CAA record, any public authority may issue for your domain.
  • Add every authority you actually use, or issuance will start failing.
  • An iodef entry gives authorities somewhere to report violations.

Look up a CAA record yourself

dig (macOS / Linux)

dig CAA example.com +short

nslookup (any OS)

nslookup -type=CAA example.com

Your resolver may still be serving a cached copy — our propagation checker queries 30+ resolvers worldwide so you can see who already has the new CAA record.

Look up a real CAA record

Query any domain live and see every record type with its TTL.

Run a DNS lookup