DNSSEC & CAA Checker
Check whether a domain's DNSSEC validates and which certificate authorities its CAA records allow.
Looks up live data What you enter is sent to our server to fetch live results from public sources. Results are cached briefly.
Report a problem with this tool
About this tool
Enter a domain and the tool asks Cloudflare's public resolver (1.1.1.1) for its records over DNS-over-HTTPS. For DNSSEC it reports whether the answers validate (the AD flag), lists the DS records published at the parent with their signing algorithm and digest type, and counts the DNSKEY records. If the resolver returns an error that disappears when validation is switched off, the chain is reported as broken: the usual cause is a DS record at the registrar that no longer matches the zone's keys after a DNS provider change. For CAA it reads the records that say which certificate authorities may issue certificates, following the standard rule that a name without its own CAA records inherits those of the closest parent. A domain with no DS record is simply unsigned, which is common and not an outage. DNSSEC state is as seen by one resolver, so a very recent change may not show yet.
How to use it
- Enter a domain, for example example.com.
- Press Check DNSSEC and CAA.
- If the chain is broken, compare the DS record at your registrar with the keys your DNS provider publishes.
- Review the CAA issuers and add or remove entries when you change certificate provider.
Common problems
- The domain shows as unsigned
- No DS record exists at the parent. Enable DNSSEC at your DNS provider, then add the DS record they give you at your registrar.
- Certificate issuance fails after adding CAA
- The certificate authority you use is not listed in an issue record. Add it, and check issuewild for wildcard certificates.
- Results differ from another tool
- Resolvers cache. Wait for the record's TTL to expire after a change, then check again.