CAA record
Declares which certificate authorities are allowed to issue certificates for the domain. Authorities are required to check it.
What one looks like
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Things worth knowing
- With no CAA record, any public authority may issue for your domain.
- Add every authority you actually use, or issuance will start failing.
- An iodef entry gives authorities somewhere to report violations.
Look up a CAA record yourself
dig (macOS / Linux)
dig CAA example.com +short
nslookup (any OS)
nslookup -type=CAA example.com
Your resolver may still be serving a cached copy — our propagation checker queries 30+ resolvers worldwide so you can see who already has the new CAA record.
Look up a real CAA record
Query any domain live and see every record type with its TTL.