Free domain tool
See which certificate authorities are allowed to issue for a domain — and whether the policy accidentally blocks all of them.
A CAA record does not fail loudly. RFC 8659 treats an issue value it cannot read as authorising nobody, so a typo in a CA name forbids every authority from issuing rather than being ignored. The same applies to a critical flag on a tag your CA does not recognise. This checker follows the record set up the domain tree the way a CA does, and reports which name the policy was actually found at.
This reads the policy only. It does not fetch your certificate, so it does not tell you whether the CA that issued your current certificate is one this policy allows. For certificate and HTTPS availability, use the SSL Certificate Checker. For the wider DNS picture, use the DNS Health Check, or the Nameserver Checker to find a nameserver that is listed but not serving the zone.
A CAA record (RFC 8659) names the certificate authorities allowed to issue certificates for a domain. A CA is required to check it before issuing, so it limits which CAs can produce a valid certificate for you.
Not in itself. No CAA record means any certificate authority may issue, which is the default for most of the internet. It is a restriction you have not applied yet rather than a vulnerability, and this checker scores it that way.
RFC 8659 says a malformed issue value is treated as an empty issuer name, which authorises nobody. So a typo in a CA name does not get ignored — it silently forbids every CA from issuing. The same happens if you set the critical flag on a tag your CA does not recognise, because then the CA must refuse.
No. When issuewild is absent, the issue records govern wildcard certificates too. Adding issuewild is only needed if you want wildcards handled by a different set of CAs, so this checker does not report its absence as a finding.
Yes. A CA walks up the domain tree until it finds a CAA record set, so a policy on the parent governs the subdomain. This checker reports which name the policy was actually found at, so an empty answer at your exact name is not mistaken for having no policy.
It gives certificate authorities an address to report issuance requests your policy refused. It is optional and relatively few CAs send these reports, so a missing iodef is treated here as a small visibility gap, not a weakness.
No. This checker reads the CAA policy from DNS. It does not fetch your certificate and does not verify that the CA which issued your current certificate is one the policy allows — that is a separate question requiring the live certificate.
It means the CAA lookup did not complete — a SERVFAIL, a timeout or a broken alias chain — so nothing can be said and no score is produced. That is different from a lookup that completed and found no policy, which is a measured result and does count.