NetKit

CAA record lookup

See which certificate authorities are allowed to issue SSL/TLS certificates for a domain, following the DNS tree upwards exactly as a CA does before issuing.

CAA lookup
Try:

Enter a hostname to see which CAs may issue for it.

Adding a CAA record

At your DNS host, add a record of type CAA on the apex (@). For a site on Let's Encrypt with a monitoring address:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

The second line forbids wildcard certificates from any CA. List every CA you actually use, including the one your CDN uses (Cloudflare, for example, issues through several CAs and adds CAA automatically when needed).

Questions people ask

What is a CAA record?
A Certification Authority Authorization record (RFC 8659) lists which certificate authorities may issue certificates for a domain. Since September 2017 every public CA must check CAA before issuing.
What if a domain has no CAA record?
Then any CA may issue. CAs climb the tree: for www.shop.example.com they check that name, then shop.example.com, then example.com, and use the first CAA set they find. This tool does the same climb.
What do issue, issuewild and iodef mean?
issue authorises a CA for normal certificates, issuewild for wildcard certificates (it overrides issue for wildcards), and iodef gives a mailto: or https: address where CAs report refused requests.
My certificate renewal fails with a CAA error. Why?
The CA you use is not listed. Add a record such as 0 issue "letsencrypt.org", 0 issue "pki.goog", 0 issue "digicert.com" or 0 issue "sectigo.com", or remove CAA entirely.