CAA DNS Lookup with a clear result

For web teams checking a launch or tracing a fault, this test provides an immediate point of reference. See which certificate authorities a domain permits through CAA.

See which certificate authorities a domain permits through CAA. The result organizes the useful evidence so you can focus the diagnosis.

How to use

Enter the domain whose CAA policy you want to inspect, using the exact name you manage.
Launch the lookup to query the published CAA records for that domain.
Read the authorized certificate authorities and any related flags shown in the result.
Compare that list with the certificate providers you actually use for the site.
Clear the field to test another domain or to recheck after a DNS change.

Example

Before requesting a certificate for a domain, you check its CAA records to make sure the chosen authority is allowed. This helps avoid an issuance failure caused by a published restriction, and it gives you a clear view of the domain's current certificate policy.

Limits and formats

The tool shows published CAA records, but it does not request, validate, or renew a certificate.
No CAA record means no restriction of this type is published, not that an authority is forbidden.
Certificate authorities may treat CAA records differently, so check their rules before drawing a conclusion.
A recent record can take time to appear because of DNS propagation, so retest after a delay.

Where processing happens

The domain you enter is sent to the YOORfree server, which queries public DNS itself and returns the CAA records it finds. No file is uploaded; the request only checks the authorized certificate authorities. You can repeat the lookup whenever your certificate provider or DNS setup changes.

Frequently asked questions

What does an empty CAA list mean?

An empty list means that no CAA record is published for the domain. It does not automatically block an authority, but it does mean no CAA restriction is visible, so the domain relies on other controls.

Can I use this check before ordering a certificate?

Yes, it is a useful pre-check. Confirm that the intended authority appears among those allowed, then consider that authority's own rules and validation requirements before placing the order.

Does the test cover subdomains?

Enter the exact name you need to examine. A subdomain can have its own CAA records or inherit the parent domain's records depending on the DNS setup, so the answer can vary by host.