What this check shows
CAA records let a domain owner restrict which certificate authorities may issue certificates. They can also define wildcard policies and incident-reporting contacts.
Comparing CAA responses helps verify policy changes before requesting or renewing a certificate.
When to use it
- Certificate authority migrations
- Restricting certificate issuance
- Diagnosing failed certificate orders
- Checking wildcard certificate policy
How to read the result
- The issue tag applies to ordinary certificates while issuewild controls wildcard certificates.
- Certificate authorities walk up the DNS hierarchy when no CAA record exists at the exact hostname.
- An incorrect or stale CAA policy can prevent a legitimate certificate order.
Command examples
Use these dig commands when you need to compare DNSRadar with a terminal check or collect evidence for a DNS provider.
Terminal
dig example.com CAA +short
dig @1.1.1.1 example.com CAA
dig subdomain.example.com CAA +noall +answerQuestions
Is CAA required for HTTPS?
No. It is an optional control that restricts certificate issuance when present.
Why can a parent-domain CAA record affect a subdomain?
Certificate authorities search parent labels when the queried hostname does not publish its own CAA policy.