Free tool
CAA record lookup
Free CAA DNS lookup: see which certificate authorities may issue TLS certs for your domain — critical for Let’s Encrypt.
CAA DNS records restrict which certificate authorities may issue TLS certificates for your domain. Empty CAA allows any CA; a restrictive set can block Let’s Encrypt renewals.
Why CAA matters
After a security team adds CAA for a private PKI, ACME clients suddenly fail. Checking CAA before renewals prevents surprise outages.
Let’s Encrypt
If you use Let’s Encrypt, ensure an issue/issuewild property allows letsencrypt.org (unless you intentionally switched CAs).
FAQ
Deeper guide: Read: CAA and Let’s Encrypt failures