CAA lookup
See which certificate authorities are allowed to issue certificates for the domain.
About CAA lookup
What it is
CAA records (Certification Authority Authorization) specify which certificate authorities are allowed to issue TLS certificates for the domain. If no CAA exists, any of the hundreds of trusted authorities can issue a certificate.
Why it matters
An attacker who manages to trick a certificate authority can issue a fake certificate for your domain. CAA limits who is even allowed to try, and thereby reduces the window of risk considerably.
Tips
- Add CAA for the authority or authorities you actually use (e.g. letsencrypt.org or digicert.com).
- Add an iodef line with your email address if you want to be notified of unauthorized certificate attempts.
- Do not forget the wildcard record (issuewild) if you issue wildcard certificates.
Common questions
What happens if I have no CAA records?
It is not an error in itself, but it means that any trusted certificate authority in the world can issue certificates for your domain without your knowledge.
Can CAA records stop me from renewing certificates?
Yes, if your authority is not listed in the CAA record. Always check that you list the correct authority before enabling CAA.
More lookups
MX lookup
See which servers receive mail for a domain, and which provider handles it.
SPF check
Check whether a domain has an SPF record and how strictly it rejects spoofed mail.
DMARC check
See whether a domain has DMARC and which policy it uses against spoofed mail.
DKIM check
Look for DKIM signing on a domain using the most common selectors.
DNSSEC check
See whether a domain is protected with DNSSEC, that is, whether its DNS answers are signed.
TXT lookup
List all TXT records for a domain, including SPF, verifications and more.
NS lookup
See which name servers control a domain's DNS.
Blacklist check
Check whether a domain's IP address is on blacklists such as Spamhaus, Barracuda and SpamCop.
A/AAAA lookup
See which IP addresses a domain points to, both IPv4 (A) and IPv6 (AAAA).
CNAME lookup
See whether a domain is an alias that points on to another domain.
SOA lookup
See the zone's core data: primary name server, contact and serial number.
Reverse DNS (PTR)
Look up which host name a domain's IP address points back to.
MTA-STS
See whether a domain requires encrypted mail delivery via MTA-STS.
TLS-RPT
See whether a domain receives reports about failed encrypted mail delivery.
BIMI
See whether a domain publishes a logo that can be shown in the recipient's inbox.
SSL certificate
Check a domain's TLS certificate: issuer, validity and expiry.
Whois
See who owns a domain, when it was registered and when it expires.
HTTP security headers
Check whether a domain's website sets important security headers.