Truvo Free Tools

CAA record checker

A CAA record tells every certificate authority in the world whether it may issue a TLS certificate for your domain. Without one, any CA can. This checker reads the CAA records, shows which issuers are permitted and whether violation reporting is set, and names the SOC 2 and ISO 27001 controls the answer affects.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 A1.2ISO 27001 A.8.20ISO 27001 A.8.14ISO 27001 A.8.24
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the CAA record checker works

The lookup is passive: it reads your domain's public CAA records through DNS over HTTPS and never touches your servers.

01

Query

You enter a domain. The tool asks a public DNS over HTTPS resolver for CAA records at the domain. Certificate authorities perform the same lookup, walking up to the parent domain, before they issue.

02

Read

The result lists each issue and issuewild tag with the CA it permits, and any iodef address for violation reports. No CAA record is flagged: it means every public CA may issue for the domain.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.7 and A1.2, and ISO 27001:2022 A.8.20, A.8.14 and A.8.24 (use of cryptography). A CAA record naming only your CAs is evidence; its absence is a gap to close.

Found a gap? We fix it for you.

Truvo's security engineers harden DNS and TLS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • CAA records

  • DNSSEC signing

  • Redundant nameservers

  • TLS and HSTS

  • Audit evidence

  • Fixed-price scope

CAA record checker: frequently asked questions

Certification Authority Authorization, defined in RFC 8659, is a DNS record that names the certificate authorities permitted to issue certificates for a domain. Publicly trusted CAs are required to check it before issuing, so a CAA record shrinks the list of organizations that could issue a certificate in your name from hundreds to the ones you actually use.

Any publicly trusted CA may issue a certificate for your domain. That is the default for most domains and it is not a misconfiguration, but it means a fraudulently obtained certificate from any CA would be valid. Publishing CAA is one of the cheapest reductions of that exposure.

Only if it omits a CA you use. List every issuer, including the one behind your CDN, load balancer or hosting provider, since managed certificates are issued in their name. Let's Encrypt is letsencrypt.org; check each provider's documentation for the exact issuer domain.

issue governs certificates for the exact name; issuewild governs wildcard certificates such as *.example.com. If only issue is set, it applies to wildcards as well. Setting issuewild to ; forbids wildcards entirely, which some teams use to keep certificate scope narrow.

Truvo maps CAA findings to SOC 2 CC6.1, CC6.7 and A1.2, and to ISO 27001:2022 Annex A controls A.8.20 (networks security), A.8.14 (redundancy of information processing facilities) and A.8.24 (use of cryptography). The mapping is advisory and is not a substitute for an audit.