CAA Record Lookup

A CAA record tells certificate authorities whether they may issue a certificate for a domain. RFC 6844 defined it in 2013, RFC 8659 revised it in 2019, and the CA/Browser Forum Baseline Requirements have obliged every publicly trusted CA to check it since 8 September 2017. A CA that finds a CAA record which does not name it must refuse to issue.

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:[email protected]"

Each record has a flags byte, a tag and a value. The issue tag names a CA allowed to issue ordinary certificates, issuewild names one allowed to issue wildcards, and a value of a single semicolon means no CA at all. The iodef tag gives a mailto or https address where a CA reports a refused request. Flag 128 marks a record as critical: a CA that does not understand the tag must not issue. Nearly every record uses flag 0.

A CAA lookup returns every CAA record at the name with its flags, tag and value. Our DNS lookup tool asks Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and OpenDNS at the same time and marks whether they agree. A certificate request that fails right after a CAA change usually just needs the old records to expire from the CA's resolver. An empty result, which most domains return, means any publicly trusted CA may issue for it.

Open Command Prompt or PowerShell. nslookup ships with every version of Windows, and Resolve-DnsName is the PowerShell cmdlet. Add a resolver address, as in the last two lines, to ask a public resolver instead of your network's.

nslookup -type=CAA example.com
Resolve-DnsName -Type CAA example.com
nslookup -type=CAA example.com 8.8.8.8
Resolve-DnsName -Type CAA example.com -Server 1.1.1.1

macOS ships dig, so no install is needed. Open Terminal and run one of these. The +short form prints only the record values, and the @ form sends the query to a specific resolver.

dig CAA example.com
dig CAA example.com +short
dig @1.1.1.1 CAA example.com

dig and host come from the dnsutils package on Debian and Ubuntu and from bind-utils on Fedora and RHEL. The +noall +answer options print only the answer section, and +tcp forces the query over TCP when you suspect a truncated UDP answer.

dig CAA example.com +noall +answer
host -t CAA example.com

After you change a CAA record, the authoritative nameservers answer with the new value immediately, and every recursive resolver that cached the old record keeps serving it until the cached TTL runs out. Our DNS lookup tool above shows whether Google, Cloudflare, Quad9 and OpenDNS agree yet, and the Authoritative option reads the value straight from the zone's own nameservers. The DNS propagation checker asks resolvers in more locations and lays the results out side by side.

RFC 8659 section 3 defines the search. The CA looks up CAA at the exact name in the certificate request. If there are none, it moves up one label and looks again until it finds a CAA set or runs out of labels. The first set found applies to every name below it that has no set of its own, so a record at example.com covers www.example.com and anything deeper. CNAMEs are followed, so a CAA set at the target of an alias counts.

For a wildcard request the CA reads issuewild records if any exist and issue records otherwise, and for an ordinary name issue records only. It issues if a value matches its own identifier or if the relevant set is empty. RFC 8657 adds two optional parameters after the CA name: accounturi pins issuance to one ACME account, and validationmethods restricts which validation methods the CA may use.

The value is a domain name that identifies the CA, published in its Certification Practice Statement.

A domain proxied by Cloudflare needs letsencrypt.org, pki.goog, digicert.com and ssl.com in its issue set (Cloudflare adds them automatically when it hosts the DNS). Check the certificate your site serves with our SSL checker and make sure its issuer is listed.

• Blocking your own CDN or host. An issue record for one CA refuses every other, including the one Cloudflare, Vercel, Netlify or your load balancer uses for automatic certificates, and the next renewal fails.
• Misreading issuewild. When no issuewild record exists, wildcard requests fall back to the issue set. When one exists it replaces the issue set for wildcards, even for CAs in the issue list.
• A CAA record on a CNAME name. A name that holds a CNAME cannot hold a CAA record, so put it on the alias target or the parent name.
• Nameservers that fail on unknown types. A CA treats a SERVFAIL or timeout on the CAA query as a failure, so old nameservers that choke on type 257 block issuance for the whole domain.

Every lookup on DNSX is also a JSON endpoint on api.dnsx.dev that you can call from curl or a script with no API key. The response has one result per resolver with its records and TTLs.

curl https://api.dnsx.dev/dns/caa/google.com