How to use CAA record analyser
Inspect CAA flags, issuer authorisations and reporting properties from pasted record values. The check runs when you submit the form. Its inputs are processed in this browser.
How the check works
Enter CAA record data as flags, property tag and quoted value. The tool checks flags, known properties and issuer-value syntax.
The Overview tab explains the findings. Measured data lets you search individual fields and values, while JSON report shows the complete export. Export JSON to retain a baseline, or print the findings for your own records. Review the report before sharing it: browser characteristics, token claims, and file names can reveal information about your setup.
Read the result in context
issue and issuewild constrain certificate issuance when the effective CAA policy applies. An empty issuer value denies that type of issuance; iodef names a reporting destination.
Understand the limits
No DNS ancestor search is performed. This tool cannot establish the effective policy for a real hostname or predict a certificate authority’s decision.
Common questions
Where is the input processed?
In this browser tab. This tool does not submit its input to the site server or a third-party service.
What should I keep with a result?
Record the selected options, browser and time. Review exported values before sharing them. Generated passwords, tokens and HMAC secret keys are excluded from report exports.