MyWebDNS

Independent DNS observations

Check CAA records across available probe locations.

CAA records state which certificate authorities may issue certificates for a domain.

1 probe configured
  • EvidenceAnswer, TTL, probe status and latency
  • Record typesA through CAA, including PTR
  • LocationProbe-reported coordinates, never random markers

QUERY / DNS

Run a DNS check

DNS

Use a hostname for most records. PTR also accepts an IPv4 or IPv6 address.

Native browser record menu.

Lookup requests are protected against cross-site submission and rate limited.

Observation desk

DNS results

Every row is one sampled probe observation. Agreement describes matching answers among probes that returned data; it is not an uptime or country-wide propagation score.

Ready for a lookup

Enter a domain and choose a record type to populate the observation map and result table.

DNS record field guide

How to read a CAA record check

CAA records state which certificate authorities may issue certificates for a domain.

When to use this lookup

Use this lookup after changing certificate providers or when an ACME order reports that issuance is not authorized.

Example

example.com CAA 0 issue "letsencrypt.org"
Answer shape
Flags, a policy tag such as issue or issuewild, and a certificate-authority value.
Common failure
The intended CA is not authorized at the effective lookup name, or an unknown critical property prevents issuance.
Related checks
CNAME record

Troubleshooting checklist

  • CAA is inherited up the DNS tree when no record exists at the exact name.
  • Use issuewild for wildcard-certificate policy when needed.
  • Unknown critical tags can instruct a certificate authority to stop processing.