isitdns?

CAA check: which certificate authorities can issue for a name

caa check

Which certificate authorities does this name allow to issue, and is the record there at all?

isitdns.net/#dig: the same question over DoT, Do53 over TCP and UDP, IPv6, or at any public resolver address.

read
  • GO issue "<your CA>" in the answer at this name. For a wildcard certificate, issuewild "<your CA>": where an issuewild record exists the issue records are not read for the wildcard, and where none exists the issue records are (RFC 8659 section 4.3). No CAA at this name: ask each parent the same way, as the CA does (RFC 8659 section 3). The sweep's cert line (/api/sweep?domain=example.com) names the CAA it found from the name up to the apex and says what it did not ask; above the apex it does not look. With none at the name or any parent, any CA can issue.
  • NO GO a CAA set that names another CA, or issue ";" -> zone owner: add 0 issue "<the CA's domain>" at the name or the apex (RFC 8659 section 4.2). A CA climbs from the name through every parent, up to but not including the root, until it finds a CAA set, and uses that one (RFC 8659 section 3): a record at the apex covers every name below it that has none of its own, and a name with none at the apex either is covered by whatever the TLD publishes.
example

google.com CAA, read 2026-10-18T22:02:04Z:

  isitdns · dig · google.com CAA
  ;; asked 2026-10-18T22:02:04.057Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 21 ms · 66 bytes · NOERROR · flags: qr rd ra
  ;; asked 2026-10-18T22:02:04.057Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (1)
  google.com.                    86400  IN  CAA    0 issue "pki.goog"
  ;; EDE: none received

  ;; the same question from your own machine: dig +https @cloudflare-dns.com google.com CAA +dnssec

  browser: https://isitdns.net/dig?name=google.com&type=CAA&resolver=cloudflare

example.com CAA, a name with no CAA record, read 2026-10-18T22:02:04Z:

  isitdns · dig · example.com CAA
  ;; asked 2026-10-18T22:02:04.644Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 10 ms · 357 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-18T22:02:04.644Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (0): the name exists and has no CAA record
  ;; AUTHORITY (4)
  example.com.                    1800  IN  SOA    elliott.ns.cloudflare.com. dns.cloudflare.com. 2416374680 10000 2400 604800 1800
  example.com.                    1800  IN  RRSIG  SOA 13 2 1800 20261019230204 20261017210204 34505 example.com. +bxwaDN6uoiJClU4YfLL5hrR6bHbcj+XnkDMntBfTj/3Dj6mLUEimZlPI7IwztFWJV+mUM3Ub1mRj9xVM2w1xw==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  example.com.                    1800  IN  NSEC   \000.example.com. A NS SOA PTR HINFO MX TXT AAAA LOC SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA HIP CDS CDNSKEY OPENPGPKEY SVCB HTTPS URI
  example.com.                    1800  IN  RRSIG  NSEC 13 2 1800 20261019230204 20261017210204 34505 example.com. 9S/06+tm3pIUe+79zS8uEm4s3cUD5PGkZex5HzDVEUqhMap2iZFmZzj+JJF65wUsxQrv/NpfxdEScVRq9UFoxA==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; the same question from your own machine: dig +https @cloudflare-dns.com example.com CAA +dnssec

  browser: https://isitdns.net/dig?name=example.com&type=CAA&resolver=cloudflare
from your own machine
dig +https @cloudflare-dns.com google.com CAA +dnssec

Ask every parent too, the same way: the CA does, and this page asks one name per run.

the manual
other jobs