About domains and DNS
What is a CAA record?
A DNS record authorizing certificate authorities to issue certificates.
Updated: October 9, 2026
A CAA record authorizes certificate authorities to issue TLS certificates for a domain. Common tags include issue, issuewild, and iodef.
Reading the result
Enter the certificate's hostname in DNS Lookup, select CAA, complete verification, and search. For a wildcard certificate, enter the domain without the *. prefix.
NetKarte separates the flag, tag, value, and TTL. Certificate authorities check CAA before issuance.
Limitations
No CAA at the queried name alone does not establish that issuance is unrestricted. A CA's checks also involve parent names and aliases. NetKarte displays the requested CAA response, not the complete certificate-issuance checking procedure. CAA alone does not guarantee certificate or website safety.
Do not mix issue and issuewild
If an illustrative response has one issue and one issuewild record, read ordinary and wildcard issuance policies separately. Keep each Tag, Value, and Flag in its own record. iodef describes reporting, not an issuing CA's name.
When issuance fails, query CAA for the target and compare with your CA's required value. Do not delete policy based only on this lookup: check applicable parent names, aliases, and the CA's error explanation.