Free · no signup
CAA Record Generator & Checker
See which certificate authorities a domain currently allows to issue — and build a
correct CAA record set for your own domain in seconds.
Build your CAA records
Everything below runs in your browser — nothing is sent to our server. Tick the CAs you use,
copy the lines into your DNS zone.
That doesn’t look like a domain — using example.com in the output for now.
For parked domains that should never have a certificate. Overrides the CA selection above.
Enter a valid email address for the iodef report line.
Adds an iodef record so CAs can report requests your policy rejected.
128 means “CAs that don’t understand this tag must refuse to issue”. All CAs understand
issue, issuewild and iodef, so 0 is what you almost always want.
Your zone-file lines
Paste these lines into your DNS zone (or add each as a CAA record in your DNS provider’s
dashboard: flags, tag and value are separate fields there). Then re-check your domain
above to confirm what resolvers actually serve.
The flags byte, decoded
0
Default. CAs that don’t recognise the tag simply ignore the record. Use this.
128
Critical. A CA that doesn’t understand the tag must refuse to issue. Only useful with non-standard tags.
Who is allowed to issue certificates for your domain?
A CAA record (Certification Authority Authorization, RFC 8659) is a small DNS record with a big
job: it names the certificate authorities that are allowed to issue certificates for your domain.
Before any publicly trusted CA signs a certificate, it must look up your CAA records and refuse
if it isn’t listed. One line of DNS turns “hundreds of CAs could be tricked into issuing for my
name” into “only the one or two I actually use”.
The lookup works the way our checker above does: the CA queries CAA at the exact name it wants to
issue for, and if nothing is there, climbs the tree one label at a time —
shop.example.com, then example.com — until it finds a CAA record set.
The first set found is the whole policy; records higher up are ignored after that. And if the
climb reaches the top empty-handed, nothing is restricted: no CAA means every publicly
trusted CA may issue for your domain. That’s the default state of most of the internet,
which is exactly why adding a record is such cheap insurance.
The values must name the CA’s issuer domain, not its brand. The classic trap is ZeroSSL:
it issues certificates from Sectigo’s roots, so the correct value is
issue "sectigo.com" — authorize zerossl.com instead and your renewals
quietly start failing. Wildcards get their own tag (issuewild), and an
iodef record tells CAs where to report requests your policy rejected — a free
tripwire that emails you when someone tries. Our generator above gets all of this right for the
common CAs; for the deeper story, read our
guide to CAA records.
One honest caveat: CAA is enforced at issuance time only, and it lives in DNS — anyone who can
change your DNS can change your CAA. It narrows who can issue; it doesn’t tell you what
was issued, and it’s not a substitute for
monitoring your certificates.
CompleteStatus watches your certificates and DNS records around the clock and alerts you the
moment something changes — start monitoring free.
Frequently asked questions
A CAA (Certification Authority Authorization, RFC 8659) record is a DNS record that names which certificate authorities are allowed to issue certificates for your domain. Every publicly trusted CA must look up your CAA records before issuing and refuse if it is not listed — so a correct CAA set stops mis-issuance by every CA you don’t use.
Nothing is restricted — any publicly trusted CA may issue certificates for the domain. That is the default for most of the internet. Publishing a CAA record shrinks that to only the CAs you actually use, so an attacker who tricks some other CA still can’t get a valid certificate for your name.
Use issue "sectigo.com". ZeroSSL issues certificates from Sectigo’s roots, so the CAA check happens against sectigo.com — authorizing zerossl.com alone will not work and issuance will fail.
The flags byte marks a record as critical. 128 means a CA that does not understand the record’s tag must refuse to issue. For the standard tags (issue, issuewild, iodef) 0 is what you almost always want — every CA already understands them.
No. CAA is checked only at issuance time. Adding or tightening a CAA record never revokes or breaks a certificate that already exists — it only controls who can issue new ones (including renewals, so keep your current CA listed).
Don’t check it once — watch it 24/7
A CAA record you set once can be changed by anyone who hijacks your DNS. CompleteStatus runs this exact check around the clock and alerts you the moment something changes — before your users (or attackers) notice.
Monitor this free
Try the other free tools
Uptime is table stakes. We watch the rest — security headers, email authentication, certs and DNS, with the fix attached.
Start free
Product
Resources
Account
© 2026 CompleteStatus. All rights reserved.
CompleteStatus — operated in the United States
·
support@completestatus.com