What this check shows
CAA records let a domain owner restrict which certificate authorities may issue certificates. They can also define wildcard policies and incident-reporting contacts.
Comparing CAA responses helps verify policy changes before requesting or renewing a certificate.
When to use it
- Certificate authority migrations
- Restricting certificate issuance
- Diagnosing failed certificate orders
- Checking wildcard certificate policy
How to read the result
- The issue tag applies to ordinary certificates while issuewild controls wildcard certificates.
- Certificate authorities walk up the DNS hierarchy when no CAA record exists at the exact hostname.
- An incorrect or stale CAA policy can prevent a legitimate certificate order.
Command examples
Use these dig commands when you need to compare DNSRadar with a terminal check or collect evidence for a DNS provider.
dig example.com CAA +short
dig @1.1.1.1 example.com CAA
dig subdomain.example.com CAA +noall +answerQuestions
Is CAA required for HTTPS?
No. It is an optional control that restricts certificate issuance when present.
Why can a parent-domain CAA record affect a subdomain?
Certificate authorities search parent labels when the queried hostname does not publish its own CAA policy.
Related DNS tools
Check DNS records worldwide across independent public resolvers for A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV and CAA answers.
Check DNS propagation worldwide and compare record values, status and latency across independent global DNS resolvers.
Run a global A record lookup to check IPv4 addresses, TTL values and propagation across independent DNS resolvers.
Check AAAA records worldwide to verify IPv6 addresses, propagation, TTL behavior and resolver differences before or after a dual-stack change.
Check CNAME records worldwide, compare canonical targets across public DNS resolvers and detect stale aliases after CDN, SaaS or hosting changes.
Check MX records worldwide, compare mail server hostnames and priorities, and diagnose email delivery or migration issues across global DNS resolvers.