CAA checker

CAA is a DNS record that tells certificate authorities who is allowed to issue a certificate for a name. Each record has a flag number, a tag, and a value. The tag issue names an authority that may issue a normal certificate. issuewild names an authority that may issue a wildcard. An empty issue value means nobody may issue. iodef is a contact, usually a mailto address, for reports about issuance. issuevmc names who may issue the evidence document some BIMI logos use. The low bit of the flags is the critical bit. An authority that does not understand a critical tag is supposed to refuse the certificate.

This check reads the CAA records of the domain you type from public DNS. It does not ask an authority to issue anything, and it does not open port 443. If the domain has no CAA records, any trusted authority may still issue. That is allowed, and it is weaker than naming the one or two authorities you actually use. CAA is inherited. A name with no records of its own uses the records of a parent, up to the point a parent has some. This page shows the records on the name you typed, not the walk up the tree.

How to read the tags

A short list of issue tags is the usual policy: the authority that already issues your certificates, and no one else. Add issuewild only when wildcard certificates are a separate decision. An empty issue tag is a lock, useful on a name that must never have a public certificate. iodef does not choose an issuer. It only says where a report can go. The critical flag is rarely needed on issue, because authorities already understand that tag. It matters when you set a tag some authorities might skip.

Common mistakes

• Naming one authority and then buying a certificate from another. Issuance fails, or the new authority is simply not in the set.
• Setting issue and forgetting issuewild, then requesting a wildcard. Wildcard rules are separate when an issuewild tag exists. When it does not, issue also covers wildcards.
• Publishing CAA only on www. A certificate for the apex looks at the apex.
• Using CAA as a substitute for watching certificate transparency. CAA is a request to authorities. Logs show what was issued anyway.

If you publish a BIMI logo that needs an evidence document, the issuevmc tag is the CAA piece of that story. The BIMI checker reads the logo record. This page reads who may issue.