[ Free tool · DNS & Mail Servers ]

CAA Record Checker

See which certificate authorities may issue TLS certs for you.

[ About this tool ]

This CAA checker finds the Certification Authority Authorization policy for a domain, walking up to parent domains as CAs do, and lists which authorities may issue certificates.

How to read the results

  • ›No CAA means any CA may issue certificates for you.
  • ›issue controls normal certificates, issuewild controls wildcards.
  • ›An iodef address lets CAs report blocked requests.

Frequently asked questions

Why does CAA matter for email security?

Mail servers, MTA-STS policy hosts and webmail all use TLS certificates. CAA limits who can issue them, reducing mis-issuance risk.

Learn more in our guide: Email Security: Stop Spoofing, Phishing and BEC

[ Get this fixed for me ]

Free expert review of your result

Our team reviews this result and sends you the exact fixes, at no cost.

[ More tools ]

Full Domain Health Scan

Run every email security check at once and get one score.

NameServer Checker

List a domain's nameservers and catch lame or single-point-of-failure DNS.

CNAME Lookup

Follow a CNAME chain and catch a dangling target before someone else does.

Lookalike Domain Finder

Find typo and homoglyph domains that could impersonate you.

DMARC Checker

Look up and explain any domain's live DMARC record.

SPF Checker

Validate your SPF record and check the 10-lookup limit.