# CAA Record Lookup

Look up CAA records to see which certificate authorities may issue certificates for a domain, and compare them with the CAs that issued its certificates in the logs.

Canonical: https://tamperbox.dev/caa-lookup

Reviewed: 2026-10-14

## Capabilities and processing

Enter a name or paste CAA records (dig or zone file lines). A name is sent to our server, which asks a public resolver; pasted records are read in your browser.

CAA records at the name, or inherited from the closest parent that has them: the CAs allowed for normal and wildcard certificates, the reporting address, and a comparison with current certificates in the Certificate Transparency logs.

## Example workflow

The sample domain allows two CAs, while the logs show current certificates from four: two of them will fail at their next renewal.

## Limits and interpretation

Without CAA records, any CA may issue. Unknown critical tags stop all issuance. Nothing is stored.

## Related tools

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)