Free CAA Records Checker
Free tool
Validate CAA DNS records to control which Certificate Authorities can issue certificates for your domain. Prevents unauthorized cert issuance and domain hijacking.
- CAA record validation and analysis
- Certificate Authority authorization check
- Wildcard and subdomain CAA coverage
No credit card requiredProduction-safe (100% passive)No setup or code required
Used by 5,000+ developers and engineering teams
What you get for free
18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.
What Essential adds from $99/mo
Pentest credits every month, +17 advanced checks, weekly continuous monitoring, email alerts, GitHub fix PRs, audit-ready PDFs for SOC 2 / ISO 27001 / PCI.
What this checker validates
- Presence and configuration of CAA records
- Authorized Certificate Authorities list
- Wildcard and subdomain CAA coverage
- CAA record syntax and policy compliance
- Certificate issuance policy validation
What are CAA Records?
CAA (Certificate Authority Authorization) records are DNS records that specify which Certificate Authorities (CAs) are authorized to issue SSL/TLS certificates for your domain. This helps prevent unauthorized certificate issuance and domain hijacking attacks.
How to configure CAA Records
- Basic CAA: 0 issue "letsencrypt.org" (allow Let's Encrypt)
- Restrictive CAA: 0 issue "digicert.com" (only DigiCert)
- Wildcard CAA: 0 issuewild "sectigo.com" (wildcard certs only from Sectigo)
- Report-only: 0 iodef "mailto:security@example.com" (report violations)
Benefits of CAA Records
- Prevents unauthorized certificate issuance by malicious CAs
- Reduces risk of domain hijacking and phishing attacks
- Provides audit trail for certificate issuance
- Enhances overall domain security posture
- Compliance with security best practices
Implementation examples
CAA records are added like any other DNS record, straight from your DNS provider's dashboard. Add these three at the root of your domain, replacing letsencrypt.org with whichever CA actually issues your certificates:
| Type | Name / Host | Value |
|---|---|---|
| CAA | @ | 0 issue "letsencrypt.org" |
| CAA | @ | 0 issuewild ";" |
| CAA | @ | 0 iodef "mailto:security@example.com" |
Some dashboards (Cloudflare, Route 53) split the value into separate flag, tag, and value fields instead of one string: flag is 0, the tag is issue, issuewild, or iodef, and the value is the CA domain or mailto address. The issuewild line with ";" blocks wildcard certificates entirely, so drop it if you use them.
Self-hosted DNS (BIND zone file)
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 issuewild ";"
example.com. IN CAA 0 iodef "mailto:security@example.com"Tool-specific questions
Are CAA records mandatory?
CAA records are not mandatory, but they are a security best practice. They provide an additional layer of protection against unauthorized certificate issuance.
What happens if I don't have CAA records?
Without CAA records, any Certificate Authority can potentially issue certificates for your domain, increasing the risk of unauthorized certificate issuance.
Can I have multiple CAA records?
Yes, you can have multiple CAA records to authorize multiple Certificate Authorities or set different policies for different types of certificates.
How do CAA records affect wildcard certificates?
Use the 'issuewild' tag to control wildcard certificate issuance separately from regular certificates. This provides granular control over certificate types.
Should I monitor CAA records regularly?
Yes, regular monitoring ensures your CAA records remain properly configured. Use Barrion's continuous monitoring to track CAA record status and detect any changes.
Why Barrion
Built for the engineers who already have enough to fix.
Speed
Real-time results
Instant analysis with a detailed report. You see findings as the scan runs, not after.
Coverage
Comprehensive checks
35+ checks per scan covering TLS, headers, CORS, cookies, DNS, email auth, and more, in a single pass.
Action
Step-by-step fixes
Every finding ships with the exact remediation step for your framework. Hand it to the engineer who owns the surface.
Other tools
More free checks, for the rest of your surface.
Complete Security Scan
Complete website security analysis with comprehensive vulnerability detection
Pre-Pentest Security Scan
Passive scan that catches the misconfigurations a pentester finds first. Use it before a manual engagement to clear the easy issues.
Security Compliance Checker
Check compliance with PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR. Get compliance readiness reports.
WAF Checker
Detect Web Application Firewall presence through passive header analysis. Identify WAF/CDN providers.
Security Headers Test
Check your website's HTTP security headers configuration
TLS/SSL Security Checker
Validate your SSL/TLS configuration and certificate setup
FAQ
Frequently asked.
What is Barrion and how does it enhance website security?
Barrion is a security testing and monitoring platform for engineering teams, and it works in two ways. Passive scanning keeps a continuous, read-only watch over your live web apps and APIs. AI pentesting goes on the offensive, running agent-driven attacks that prove which vulnerabilities are genuinely exploitable. Every finding comes with a step-by-step fix you can ship right away.
How safe is Barrion to use for security testing?
Passive scanning is completely safe to run, including against production. Passive scans only read your live app, so we never submit forms, brute-force endpoints or touch anything that changes state. AI pentesting is more aggressive by design, since its job is to confirm real exploits, so it runs rate-limited and non-destructive, and you approve the exact scope before a single request is sent.
What types of security issues does Barrion identify?
It depends on the surface. On your live apps, Barrion catches misconfigurations across TLS and HTTPS, security headers, cookie flags, CORS policy, DNS records, email authentication (SPF, DKIM, DMARC), network exposure and the usual web hygiene gaps. AI pentesting surfaces the exploitable stuff, like SQL injection, cross-site scripting and broken access control, each one backed by proof it can actually be exploited.
What specific security checks does Barrion perform?
Barrion covers two surfaces. Passive web scanning is read-only and safe to point at production, and runs 35+ checks: transport security (HTTPS, HSTS, TLS version, cipher suites, certificate expiry, hostname and chain validity, OCSP stapling), HTTP response headers (Referrer-Policy, Permissions-Policy, X-Content-Type-Options, Content-Type, server information disclosure), CSP and framing (Content-Security-Policy, bypass detection, Trusted Types, X-Frame-Options), cross-origin policy (COOP, COEP, CORP and the full CORS header set), cookie flags and anti-CSRF tokens, mixed content, vulnerable JavaScript libraries, DNS records including DNSSEC and CAA, email authentication (SPF, DKIM, DMARC), open ports and subdomain takeover. AI pentesting is the aggressive surface: it actively chains requests to confirm exploitable flaws such as SQL injection, cross-site scripting and broken access control, and returns reproducible proof for each one. Findings from both are ranked by severity and come with step-by-step remediation.
What is Barrion's smart crawling?
Smart crawling automatically discovers the pages and endpoints of your app so scans cover the surface that matters, without you manually listing every URL.
How often does Barrion perform security scans?
You can run a scan manually whenever you want. Continuous monitoring of your live apps runs on its own (weekly on Essential, daily on Business), and we alert you the moment something new shows up.
Is Barrion suitable for security testing of all business sizes?
Yes. Live-app monitoring and AI pentesting work just as well for a solo developer as for a startup, a scale-up or an enterprise security team, and it fits alongside the tools you already run.
How does Barrion handle data security and privacy during security testing?
Live-app scans are read-only by default, and we never store or expose sensitive data from your application. AI pentests are rate-limited and non-destructive, built to confirm whether something is exploitable without altering your data or affecting availability.
What if I'm not satisfied with Barrion's security testing service?
You can cancel anytime in the dashboard, and paid plans carry a 14-day refund window from the first charge. If something isn't right, contact us and we'll make it work for your team.
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Barrion produces audit-ready PDF and CSV reports suitable for SOC 2, ISO 27001, PCI DSS and NIS2, ready to share with auditors, customers and your board.
Anything else? Email contact@barrion.io.