CAA check
A CAA record limits which certificate authorities may issue SSL for your domain. A wrong CAA record makes AutoSSL renewals fail silently. The tool walks up the name and its parents per RFC 8659, finds the record in force and shows whether your chosen CA and a wildcard are allowed.
Loading the tool…
This tool runs in your browser and needs JavaScript.
How to use it
- Enter the name the certificate is for and choose the provider you want to use.
- Press the run button. Results are listed separately as definite problems, possible issues, unverifiable and passed; each finding shows what was found, what it means, the fix and the limits of the check.
- Apply the suggested fix and run the tool again to confirm. Use “Copy result” to add the report to a support ticket.
Example
If only digicert.com is allowed in CAA, the provider used by AutoSSL cannot issue; the tool reports this as a definite problem and suggests a record that keeps the existing permissions. The “Example” button in the form fills in a scenario like this and shows the result immediately.
Scope and limits
CAA records are read from public resolvers with the RFC 8659 tree-climbing rule (name → parents). The CA's internal policies and validation methods are not checked.
Your inputs are not added to the address bar or passed to analytics, and result pages are not indexed by search engines.
Related guides
More tools
Ready to Get Started?
Create your account, or write to our team if you have questions.