CAA Checker
Which Certificate Authorities are authorized to issue certificates for this domain.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: RFC 8659 — DNS Certification Authority Authorization (CAA)
About this validation
Checks which Certificate Authorities are authorized to issue certificates for a domain.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live DNS lookup performed by SEOTechTests for CAA records. Standard: RFC 8659 defines the CAA record format and how Certificate Authorities must honor it.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What is a CAA DNS record?
A DNS record that explicitly lists which Certificate Authorities (CAs) are permitted to issue TLS certificates for a domain -- any compliant CA not on the list must refuse to issue a certificate for it.
Why is CAA useful?
It reduces the risk of a certificate being mis-issued by an unauthorized or compromised CA, since compliant CAs check for a CAA record before issuing.
Is CAA required for HTTPS?
No. A domain can serve valid HTTPS certificates with no CAA record at all -- browsers don't require it, and its absence simply means any publicly trusted CA can currently issue a certificate for the domain.
Should a missing CAA record be considered a security failure?
It's reported as a lower-severity finding, not a hard failure -- CAA is a defense-in-depth measure against mis-issuance, not a baseline requirement for a secure site.