CAA Effective Policy Checker

Check effective CAA (Certificate Authority Authorization) policies by walking up the domain label chain. Determine which Certificate Authorities are authorized to issue certificates for a domain.

CAA Examples

CAA Policy Check

Understanding CAA Records

CAA Record Format

flag tag "value"
  • Flag: 0 (non-critical) or 128 (critical)
  • Tag: issue, issuewild, or iodef
  • Value: CA domain or contact information

CAA Tags

issue: Authorizes a CA to issue certificates for the domain
issuewild: Authorizes a CA to issue wildcard certificates
iodef: Specifies a URL/email for incident reporting

CAA Lookup Process

  1. Check for CAA records at the requested domain
  2. If none found, check the parent domain
  3. Continue up the tree until CAA records are found
  4. If no CAA records exist, any CA can issue certificates

Common CAA Examples

0 issue "letsencrypt.org" Allow Let's Encrypt to issue certificates
0 issuewild ";" Prohibit wildcard certificate issuance
0 iodef "mailto:[email protected]" Report policy violations to security team