← Back to the CAA Record Checker
dig CAA yourdomain.com, or pasting a hostname into a generic online DNS-record viewer,
is the first thing most people reach for when a certificate authority reports "CAA record prevents
issuance." It's the right instinct, and it isn't wrong — it's incomplete, in a way that matters
specifically for this record type.
The raw CAA record text at exactly the name you queried. If that name genuinely has no CAA records, most plain lookup tools report "no CAA record found" and stop there — a perfectly correct answer to the question they asked, which is narrower than the question you actually have.
| RFC 8659 rule | A plain lookup | This tool |
|---|---|---|
| Walk up to a parent domain when the exact name has no CAA record | Reports "none found" and stops | Walks up automatically, names the ancestor it found the applicable record at |
issuewild overrides issue for wildcard certs | Shows both records; you work out which applies | Applies the fallback rule and reports the wildcard verdict directly |
| A critical, unrecognized tag blocks every non-implementing CA | Shows the raw tag; easy to miss the implication | Flags it explicitly as a finding |
| Is a specific named CA actually authorized? | You compare the record text to the CA's issuer domain by eye | Names the verdict directly for 8 known CAs, or any CA domain you enter |
The raw CAA record text at exactly the hostname you queried — nothing more. If that name has no records, most plain lookup tools report "no CAA record found" and stop there, even when a parent domain actually restricts issuance for it.
Because RFC 8659 does not evaluate CAA at only the exact name. A certificate authority walks up the DNS tree to the first ancestor domain that publishes a CAA record set, applies the issuewild-overrides-issue fallback for wildcard certificates, and must refuse issuance entirely if any record carries the critical flag on a tag it doesn't recognize. A raw record dump tells you what's published; it doesn't tell you what those rules mean for a specific certificate authority you're trying to use.
No — both are useful, for different questions. A plain lookup answers "what CAA record is published at this exact name?" quickly, with no interpretation. This tool answers the question that actually matters when a certificate fails to issue: "which certificate authorities are authorized, once the real tree-walk and fallback rules are applied?" It is still the right tool for simply confirming a record you just added is visible. See why a CAA record blocks issuance for the full walkthrough of all four causes.