Switching from UptimeRobot? Import your monitors in one click with a read-only API key.Start free →
  1. Home
  2. Free tools
  3. CAA lookup

Free CAA lookup

See the CAA records that restrict which certificate authorities may issue for a domain.

Lookups use Cloudflare 1.1.1.1 from your browser.

Results appear here.

A CAA change can block certificate renewalPair this with Tenium’s SSL monitor, which warns 30, 14 and 3 days before a certificate expires, so a CAA change that blocks renewal does not go unnoticed.

Start free

What CAA does

CAA tells CAs whether they are allowed to issue for the name. issue authorizes normal certificates, issuewild authorizes wildcards, and iodef is where to send a report of a rejected request. An empty CAA set means any CA may issue.

Inheritance

If a name has no CAA, CAs walk toward the parent until they find one. A CAA on the apex covers the whole domain unless a subdomain sets its own.

Related checks

DNS lookup · A lookup · TXT lookup · DNS monitoring

Command-line equivalent

dig +short example.com CAA

More free tools

Is it down?Check a site from 2 regionsUptime calculatorTurn 99.9% into minutesCron expression builderBuild and explain cron schedulesSSL checkerCertificate expiry and chainDNS lookupEvery common record in one checkHTTP status codesEvery code, and what to do about itHTTP headersInspect response headersDomain expiryWhen does a domain expire?Subnet calculatorCIDR to ranges and masksResponse time testLatency from 2 regionsUptime badgeSVG badge for your READMESPF, DKIM and DMARC checkerIs your domain’s email authenticated?