What this tool does
A CAA (Certification Authority Authorization) record tells certificate authorities which of them are permitted to issue certificates for your domain. With no CAA record, any CA can issue a certificate. Adding CAA records is a simple way to reduce the risk of mis-issuance. This checker lists your CAA records so you can confirm only the CAs you trust are allowed.
Frequently asked questions
Do I need CAA records?
They're optional but recommended. Without them, any public CA can issue a certificate for your domain. With them, only the CAs you list can, which limits the blast radius of a mis-issued or fraudulent certificate.
What does a CAA record look like?
Each record names an action (issue, issuewild, or iodef) and a value, for example 0 issue "letsencrypt.org". That line authorizes Let's Encrypt to issue certificates for the domain.
No CAA records were found, is that a problem?
It's not an error, but it means any certificate authority may issue certs for your domain. Adding CAA records for your chosen CA(s) is a low-effort hardening step.