What is the CAA record type?
Certificate Authority Authorization records let a domain owner restrict certificate issuance and optionally publish an incident-reporting address.
Common uses
- Reducing unauthorized certificate issuance
- Authorizing wildcard certificates
- Publishing certificate incident contacts
What to enter
Enter the domain whose certificate policy you want to inspect.
example.comHow to read the result
The issue and issuewild properties identify allowed certificate authorities; iodef provides a reporting destination.
How CAA DNS lookups work
When a client requests a CAA record, it normally asks a recursive DNS resolver. The resolver may return a cached answer or contact the domain’s authoritative nameservers. Cached answers improve speed, but they also explain why a recent DNS change may not appear everywhere at exactly the same time.
DNSReach queries several independent public resolvers and, when possible, the authoritative nameservers for the domain. An authoritative answer reflects the zone currently published by the DNS provider. A recursive answer reflects what that resolver currently knows, which may still be an older cached value until its cache expires.
How to check a CAA record with DNSReach
- Open the DNS checker and select CAA.
- Enter
example.comin the format described above. - Run the check and watch each resolver return independently.
- Compare public resolver answers with the authoritative results marked by a shield.
- Investigate amber results because they differ from the authoritative or majority answer.
Why CAA answers can differ
The most common reason is caching. DNS records have a time to live, and resolvers that cached the previous value can continue serving it until that period ends. Differences can also come from split-horizon DNS, filtering policies, malformed responses, DNSSEC validation failures, resolver outages, or querying a hostname different from the one where the record is actually published.
A failed lookup is not always evidence that the entire domain is broken. “No record” means the requested type was not found at that exact name. A timeout means a resolver did not answer in time, while a refusal means it declined the query. Checking authoritative servers helps distinguish propagation delay from a configuration problem.
Common CAA troubleshooting steps
- Confirm the exact hostname and record type.
- Check the authoritative answer before changing the zone again.
- Allow existing cached answers to expire after a change.
- Verify that every authoritative nameserver publishes the same zone version.
- Review provider-specific formatting requirements and remove accidental duplicate records.
CAA record FAQ
What is the CAA record type?
Controls which certificate authorities may issue certificates for a domain.
How do I check CAA records?
Enter example.com in DNSReach, select CAA, and run the check. DNSReach compares public recursive resolvers with available authoritative nameservers.
Why do DNS resolvers show different CAA answers?
Resolvers may hold cached data created at different times. A recent DNS change can therefore appear on some resolvers before others until older cached answers expire.
What does “no record” mean for CAA?
The resolver answered successfully but found no CAA record at the exact name queried. This can be normal when that record type is optional or published at another hostname.