Skip to content
All tools

CAA Record Checker & Generator

CAA records tell certificate authorities which of them are allowed to issue certificates for your domain. Check what a domain publishes today and what it means, or build a correct record set for the CAs you actually use.

New to CAA? Read CAA records explained for how CAs look the records up, what the issue, issuewild and iodef tags mean, and how to publish records without breaking renewals.

Enter a hostname. Prefix with *. to see the wildcard policy. We follow the same lookup a CA does: the name itself, then each parent.

DNS-over-HTTPS, queried directly from your browser.

Lookups go straight from your browser to a public DNS resolver. The checker queries Cloudflare or Google DNS-over-HTTPS for the domain you enter; only that domain name is sent, and nothing passes through CertIntel servers. The record generator runs entirely in your browser.