ProbeKit Browse tools

CAA record check

Looks up CAA on the name and, if it has none, on its parents up to the registrable domain (RFC 8659). Reports the allowed issuers for normal and wildcard certificates, iodef targets, unknown critical tags and values that cannot be parsed.

Updated 2026-10-25

Free, no account, nothing is stored

What this tool checks

CAA (Certification Authority Authorization, RFC 8659) records say which certificate authorities may issue TLS certificates for a name. Authorities are required to check them before they issue.

The check looks for CAA records the way an authority does:

  • It queries the name you enter. If there are no CAA records, it moves to the parent name and continues up to the registrable domain, the name just below the public suffix such as example.co.uk.
  • The first name with records is the relevant set. The others are not combined with it.
  • It parses each record into its flag, tag and value. For issue and issuewild it reads the authority's domain and any parameters; for iodef it reads the reporting URL.

How to read the result

The result shows the authorities allowed for normal certificates, the authorities allowed for wildcard certificates, the iodef addresses and the name the rules were inherited from. When there are no issuewild records, the issue records also apply to wildcards.

  • No CAA anywhere is information: every authority may issue.
  • An unknown tag with the critical flag is an error, because no authority may issue at all.
  • An issue or issuewild value that does not parse is a warning (CAA_INVALID_VALUE). Authorities treat it as permitting no one.
  • An iodef URL that is not mailto: or https: is a warning (CAA_INVALID_IODEF), because authorities cannot report to it.

The CAA guide explains the record format and how to plan CAA for a domain with many services.

Limitations

  • The check does not look at certificates that already exist. Use Certificate Transparency logs for that.
  • Authority-specific parameters, such as account bindings or validation methods, are shown but not checked against the authority's rules.
  • The walk stops at the registrable domain. Records on the public suffix itself are not considered.

Use it from code

API reference for CAA record check

curl -i "https://api.probekit.dev/v1/dns/caa?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

InputDomain
Deadline10 seconds
FreshnessUp to 5 minutes, never longer than the record TTL
Price$0.01 per check

Findings this tool can report

CAA (5)
Check (1)
DNS (3)

Frequently asked questions

What happens if a domain has no CAA records?

Then any public certificate authority may issue certificates for it, as long as the usual domain validation succeeds. That is not an error, and the check reports it as information with CAA_NOT_FOUND. CAA is an extra control that limits the choice to the authorities you name.

Why does my subdomain show the CAA records of my main domain?

RFC 8659 tells a certificate authority to look for CAA records on the exact name first and, if there are none, on each parent name in turn. The first name that has CAA records decides. The check follows the same walk up to the registrable domain and tells you which name the rules came from.

What does issue ";" mean?

A record 0 issue ";" names no authority at all, so no certificate authority may issue certificates for the name. It is useful for names that should never have a certificate. The check reports it as information with CAA_NO_ISSUANCE.

Why is an unknown tag with the critical flag an error?

The critical flag (128) tells a certificate authority that it must understand the tag before it may issue. A tag no authority knows, such as a misspelling with the flag set, therefore blocks all issuance. The check reports it as CAA_UNKNOWN_CRITICAL_TAG.