See which certificate authorities may issue for a name, and which already did.
Example
CAA records
As dig shows it
Answer
Findings
Capabilities and processing
Enter a name or paste CAA records (dig or zone file lines). A name is sent to our server, which asks a public resolver; pasted records are read in your browser.
CAA records at the name, or inherited from the closest parent that has them: the CAs allowed for normal and wildcard certificates, the reporting address, and a comparison with current certificates in the Certificate Transparency logs.
Example workflow
The sample domain allows two CAs, while the logs show current certificates from four: two of them will fail at their next renewal.
Limits and interpretation
Without CAA records, any CA may issue. Unknown critical tags stop all issuance. Nothing is stored.