Free tool
CAA records tell certificate authorities whether they are allowed to issue for a domain. A CA checks the name, then its parents, and uses the first set it finds. This check walks the same path, lists the records and says what they allow. A missing or wrong record is the usual reason a certificate request fails with "CAA".
What this checks
Before issuing, a CA looks for CAA records on the exact name, then on each parent up to the registered domain, and stops at the first set it finds; a record on the parent covers every name below it that has none of its own. The issue tag lists CAs allowed to issue ordinary certificates, issuewild the ones allowed to issue wildcards, iodef where to report a refused request. A value of ";" means no CA. Records are checked at issuance time only; an existing certificate stays valid when you change them.
Related tools
Domains and DNS
Register or transfer .lu, .eu, .be, .com and more; the DNS editor, DNSSEC and the records these tools check are in the client area.
