DNS CAA Record Checker
Inspect DNS Certification Authority Authorization (CAA) records to ensure automated ACME renewals succeed and prevent rogue certificate issuance.
Understanding DNS CAA Records (RFC 8659)
Certification Authority Authorization (CAA) is a DNS resource record (Type 257) that allows domain owners to declare which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for their hostnames.
Standard Hostname Issuance
Authorizes specific CAs to issue single-domain and multi-domain certificates. Example: example.com. CAA 0 issue "letsencrypt.org".
Wildcard Certificate Policy
Controls wildcard certificate issuance (e.g. *.example.com). If set to ";", all wildcard certificates are strictly blocked.
Incident Reporting Email/URL
Specifies a reporting endpoint (mailto: or https://) to receive automated notifications if a CA receives an unauthorized issuance request.
Recommended Secure CAA Configuration
To authorize Let's Encrypt and Google Trust Services while receiving security violation alerts, configure the following DNS records:
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 issue "pki.goog"
example.com. IN CAA 0 issuewild "letsencrypt.org"
example.com. IN CAA 0 iodef "mailto:security@example.com"