← All tools

CAA Record Checker & Builder

Checks which certificate authorities a domain has authorized to issue for it, walking up to the parent domain the way a real CA has to when the exact name has no CAA record of its own (RFC 8659). If a domain has none at all, any publicly trusted CA can issue a certificate for it. Build a new record below once you know which CA you actually use.

📖 Guide: How CAA records work

Last updated: September 9, 2026

How to use this tool

1. Enter a domain above and click Check to see which certificate authorities, if any, it already authorizes.
2. If nothing is published, or the wrong CA is listed, add an authorization below for the CA you actually use.
3. Add an incident-reporting address if you want a notification when an unauthorized CA attempts to issue for your domain.
4. Copy the generated record and publish it as a CAA record at your domain's apex, not a subdomain, unless that subdomain needs its own separate policy.

Build a CAA record

Add the certificate authority (or authorities) you actually use. Most domains only need one "issue" line.