Check which Certificate Authorities (CAs) are authorized to issue SSL/TLS certificates for a domain using our CAA Record Lookup tool. Enter a domain name to inspect its DNS Certification Authority Authorization records, including certificate issuance restrictions, wildcard permissions, record flags, and TTL values.
CAA Record Lookup
Find DNS Certification Authority Authorization records for a domain and the closest parent domain with a CAA policy.
| Flags | Tag | Value | TTL (seconds) |
|---|
What Is a CAA Record?
A CAA (Certification Authority Authorization) record is a DNS record that allows a domain owner to specify which Certificate Authorities are permitted to issue publicly trusted SSL/TLS certificates for that domain.
For example, a website owner can configure a CAA record to authorize a particular certificate provider. Other Certificate Authorities must respect the applicable CAA restrictions before issuing a certificate, subject to the rules and exceptions in the relevant standard.
CAA records help reduce the risk of unintended certificate issuance. However, they do not encrypt website traffic, replace HTTPS, or guarantee protection against every type of certificate misuse.
How to Check CAA Records for a Domain
Using the CAA Record Lookup tool is straightforward:
- Enter a public domain name, such as
example.com, or paste its complete HTTPS website URL. - Click Check CAA Records.
- Review the DNS results, including the record’s flags, tag, value, and TTL.
- Check whether the records were found directly on your domain or inherited from a parent domain.
- Use Copy Results if you need to share the information with your hosting provider or technical support team.
The lookup uses the website server’s DNS resolver. It checks the entered hostname and searches parent domain names until it discovers a CAA record set.
No software installation or domain ownership verification is required to inspect publicly available DNS records.
Understanding CAA Lookup Results
A CAA record contains information describing certificate issuance permissions or related reporting instructions.
The main fields displayed by the tool are:
| Field | What it means |
|---|---|
| Flags | Indicates special processing requirements for the record |
| Tag | Identifies the CAA property, such as issue, issuewild, or iodef |
| Value | Contains a Certificate Authority identifier or reporting destination |
| TTL | Time to live, expressed in seconds, which influences how long DNS resolvers may cache the response |
CAA Issue Record
The issue property identifies one or more Certificate Authorities authorized to issue certificates for a domain.
An illustrative DNS record looks like this:
example.com. 3600 IN CAA 0 issue "ca.example.net"
In this example, ca.example.net represents an authorized Certificate Authority identifier. This is an example, not a verified record for example.com.
Multiple issue records can authorize multiple providers. An issue record with the value ";" requests that no Certificate Authority issue certificates, unless another applicable issue record grants authorization.
CAA Issuewild Record
The issuewild property controls the issuance of wildcard certificates, such as certificates covering *.example.com.
When an applicable CAA record set contains issuewild properties, those properties take precedence over issue properties for wildcard certificate requests.
If no issuewild property exists, the applicable issue properties also govern wildcard issuance.
This distinction matters when a website uses wildcard SSL certificates for multiple subdomains.
CAA Iodef Record
The iodef property specifies a destination where participating Certificate Authorities may report certain certificate issuance incidents or policy violations.
The destination may be an email address using mailto: or an HTTP/HTTPS reporting endpoint.
An iodef record provides reporting information. It does not, by itself, restrict which Certificate Authorities can issue certificates, and publishing one does not guarantee that reports will be sent.
What Do CAA Flags Mean?
The flags field is commonly set to 0.
A value of 128 sets the issuer-critical flag. If the applicable record uses an unknown or unsupported property tag with this flag, a compliant Certificate Authority must not issue the certificate.
Incorrectly configured critical records can interrupt certificate issuance, so administrators should understand their purpose before using them.
Why Does a CAA Lookup Check Parent Domains?
CAA restrictions can apply through parent domains.
For example, when checking shop.example.com, the tool first looks for CAA records on that hostname. If it does not discover any, it continues searching higher domain levels.
The first non-empty CAA record set discovered in that search is displayed.
This helps explain why a subdomain may be affected by certificate issuance restrictions configured at its parent domain.
The tool performs a basic parent-domain DNS lookup. It does not reproduce every detail of a Certificate Authority’s processing, including all DNS alias, delegation, and DNSSEC-related conditions.
What If No CAA Records Are Found?
A result showing no discovered CAA records means the server’s DNS resolver did not return a CAA record set for the names checked.
It does not necessarily indicate a problem with your website.
Domains can operate HTTPS without publishing CAA records. In the absence of applicable CAA issuance restrictions, CAA itself does not restrict which compliant Certificate Authorities may issue certificates, although other certificate issuance requirements still apply.
If you recently added a CAA record, check that it was saved in the correct DNS zone. DNS caching and propagation can affect when updated records become visible.
If your hosting provider reports a CAA-related certificate error, investigate the exact DNS response rather than assuming that no displayed records means issuance is permitted.
How to Fix Common CAA Record Problems
SSL Certificate Issuance Is Blocked
Check whether the applicable issue or issuewild records authorize the Certificate Authority your hosting service uses.
For wildcard certificates, review wildcard-specific restrictions separately.
Do not remove existing CAA restrictions without understanding which Certificate Authorities your domain needs.
CAA Record Changes Are Not Appearing
Confirm that you edited the authoritative DNS zone for your domain.
Then allow for DNS caching and check the records again. You can also compare results using your DNS provider’s management interface or an authoritative DNS query.
Unexpected Certificate Authority Appears
Review all records in the applicable CAA record set. Multiple issue entries may be intentional, especially when a website uses more than one certificate provider.
If an entry is unfamiliar, confirm its purpose with your hosting or certificate provider before changing it.
DNS Lookup Fails
A failed lookup is not the same as a result showing no CAA records.
The DNS resolver may be temporarily unavailable, the domain may have a DNS configuration problem, or the hosting environment may not support the required query.
Try again and verify the result through another trusted DNS diagnostic method if the problem continues.
How Our CAA Record Lookup Works
The NetTools Pakistan CAA Record Lookup sends the submitted domain name to our WordPress server, where a server-side DNS query requests publicly available CAA records.
The lookup displays the discovered records and the domain names checked. Recent results may be served from a short cache rather than retrieved again immediately.
The tool does not issue certificates, inspect private SSL keys, or validate an installed website certificate.
Results reflect the DNS information available through the server’s configured resolver. They may differ from information seen by another resolver or Certificate Authority.
For technical reference, CAA processing is defined in RFC 8659: DNS Certification Authority Authorization Resource Record.
When Should You Check CAA Records?
A CAA lookup is useful when setting up HTTPS for a new website, migrating hosting providers, changing certificate issuers, configuring wildcard certificates, or investigating SSL certificate issuance errors.
For Pakistani website owners using .pk, .com.pk, or other public domains, the underlying CAA standard works the same way. The important factor is the domain’s DNS configuration, not the country where its owner or hosting provider is located.
If the lookup reveals a restriction you do not recognize, contact your DNS administrator or certificate provider before making changes.
About NetTools Pakistan: NetTools Pakistan is an independent internet connectivity and network diagnostics website. This CAA lookup provides DNS information for troubleshooting and educational purposes. It is not a Certificate Authority or a certificate issuance approval service.