Skip to content

CAA Record Checker

Enter a domain and Nivaronix looks up its CAA (Certification Authority Authorization) record to report whether certificate issuance is restricted to specific CAs, or open to any public CA by default.

What this checker reports

  • CAA records published — the domain names the specific certificate authorities allowed to issue for it; other CAs must refuse.
  • No CAA record — nothing is published, so any public CA may issue a certificate for the domain. This is not an active vulnerability, it removes a cheap safety net rather than opening a hole.
  • Status could not be determined — the CAA lookup timed out or a nameserver failed to answer; some older resolvers cannot return CAA records at all, and this is reported as inconclusive.

Learn more

Check your domain's CAA record

Free, no signup for a single scan. CAA is part of every full Nivaronix scan alongside SPF, DMARC, DNSSEC, headers, and TLS.

Scan your domain free

See everything Nivaronix's website security scanner checks

A CAA record can be removed or overwritten during a DNS migration without anyone noticing. Nivaronix's platform monitors CAA alongside the rest of your DNS security posture and alerts you when it changes.

FAQ

Is 'no CAA record' a vulnerability?

No — it removes a cheap safety net rather than opening a hole. With no CAA record, any publicly trusted CA can still only issue a certificate for your domain after proving domain control through the CA's own validation process; CAA restricts which CA is allowed to do that, it doesn't remove the validation requirement itself.

Which CAs should I list in my CAA record?

Every certificate authority that actually issues for the domain, including ones you don't manage directly — a CDN or hosting platform that provisions its own certificate uses its own CA, and omitting it will block that platform's next renewal, not the current certificate.

Can I check CAA records with a normal DNS lookup tool?

Yes, if the tool supports the CAA record type specifically — dig -t CAA example.com works from any machine with dig installed. Some older resolvers and DNS panels don't support CAA lookups, which is why Nivaronix reports that case as inconclusive rather than as no-CAA.

Does CAA protect against phishing domains that look like mine?

No — CAA only restricts which CAs may issue a certificate for your exact registered domain. A phishing site on a different, look-alike domain (typosquatting, a different TLD) is unaffected by your CAA record, since it's registering and certifying its own domain, not yours.