Good Roots Work
Sign in
Start free

← All tools

Public CAA Policy

Check whether your domain has a public Certificate Authority Authorisation (CAA) policy, see how it is configured, edit an existing policy, or build and deploy a new one when none exists. Use Domain Connect where your DNS provider supports it, or follow manual DNS steps.

Analyse your domain

Enter a registrable domain (apex) to look up its current CAA records.

Try an example:

What you can do next

FAQ

What does this tool do?
It looks up Certificate Authority Authorisation (CAA) records for your domain, explains what they mean, lets you edit issue, issuewild, and iodef tags, and helps you apply changes via Domain Connect or copy-paste DNS instructions.
Do I need a CAA policy?
CAA is not mandatory, but it restricts which certificate authorities may issue TLS certificates for your zone. Without records, any public CA may issue for your domain.
Can it change my DNS automatically?
Yes, when your DNS provider supports Domain Connect (for example Cloudflare, GoDaddy, or IONOS). Otherwise the tool generates manual record add/remove steps.
Is an account required?
No. The CAA policy tool is free and public. We process the domain name and DNS data you request to perform lookups and optional Domain Connect deployment — see our privacy policy for details.