What this tool does
A CAA (Certification Authority Authorization) record tells certificate authorities which of them are permitted to issue certificates for your domain. With no CAA record, any CA can issue a certificate. Adding CAA records is a simple way to reduce the risk of mis-issuance. This checker lists your CAA records so you can confirm only the CAs you trust are allowed.
Setting CAA the right way
List every certificate authority you actually use with an issue tag, and add a separate issuewild tag if you rely on wildcard certificates, because issue alone doesn't cover them. CAA is inherited down the tree, so a record on your apex applies to subdomains unless a subdomain publishes its own. An iodef tag gives a CA an address to notify if someone requests a certificate it isn't authorized to issue. The one thing to avoid is omitting a CA you depend on, since that will block its next renewal.
Frequently asked questions
Do I need CAA records?
They're optional but recommended. Without them, any public CA can issue a certificate for your domain. With them, only the CAs you list can, which limits the blast radius of a mis-issued or fraudulent certificate.
What does a CAA record look like?
Each record names an action (issue, issuewild, or iodef) and a value, for example 0 issue "letsencrypt.org". That line authorizes Let's Encrypt to issue certificates for the domain.
No CAA records were found, is that a problem?
It's not an error, but it means any certificate authority may issue certs for your domain. Adding CAA records for your chosen CA(s) is a low-effort hardening step.
Do CAA records apply to subdomains?
Yes. A CA checks the requested name and walks up the tree, so a CAA record on your apex domain governs subdomains too unless a subdomain publishes its own record to override it. Remember that issue authorizes normal certificates while issuewild is required separately for wildcard certificates.