What is a CAA record? Check CAA records (tester) in plain English
A CAA record answers “who is allowed to mint the next certificate for this name?” Without one, any CA that can validate may issue. CrowWake’s free CAA checker is a CAA tester: it lists apex issue/issuewild rows and compares them to the live TLS issuer—not a Certificate Transparency crawl.
What is a CAA record?
Operators searching for CAA record or CAA records usually mean Certificate Authority Authorization: DNS rows at the zone apex that name which certificate authorities may issue for your domain. Each row has a flag (usually 0), a tag, and a value. Common tags: issue (non-wildcard certs), issuewild (wildcards), and optional iodef (where to report policy violations). Example shape: 0 issue "letsencrypt.org" — plus another row for any other CA you still use.
How to check CAA records (CAA tester)
1) Run the free CAA record checker on the bare domain (same CAA tester pulse CrowWake uses). 2) Note missing vs present issuers. 3) Compare the list to every place that renews certs for you (host panel ACME, CDN edge certs, commercial CA). 4) Confirm the live certificate issuer is on the allow-list—not only that some CAA rows exist. 5) If issuance just started failing, you probably published CAA without the CA your ACME client uses—fix the issue tag first, then retry ACME.
What CrowWake checks
We resolve CAA at the apex domain. Missing CAA is a warn—common on small sites, still worth noticing after a CDN or registrar move. When records exist, we summarize the issued-to tags so you spot accidental deletes. The free CAA record checker / CAA tester uses the same DNS lookup with no login—and then compares the list to the issuer on the live TLS certificate. For the repeat “watch this hourly” job, see the dedicated CAA monitoring guide.
Does CAA allow your live certificate?
Most CAA testers only list issue / issuewild rows. CrowWake also opens port 443, reads the live certificate’s issuer, and tells you whether that CA is on the allow-list. A green CAA list that omits Let’s Encrypt (or whoever actually issued today’s cert) means the next ACME renew can fail while the current lock still looks fine. That pairing is the same signal on the free CAA checker and the SSL checker.
CAA record vs CAA monitoring
This guide is the definition and publish/triage job: what a CAA record is, how to check CAA records, and how to align the allow-list with the live issuer. CAA monitoring is the earlier rooster—catch a silent wipe or issuer mismatch every hour before the next renew fails. Both use the same free CAA checker; CrowWake just repeats the pulse.
Why it matters
Mis-issued certificates are rare but painful. A CAA record is a cheap control: you name the CAs you trust (Let’s Encrypt, DigiCert, Google Trust Services, and so on). Agencies often lose CAA during zone rebuilds and never put it back. SSL expiry can stay green while your issuance allow-list silently vanishes.
What “good enough” looks like
Publish CAA for every CA you actually use—including any ACME provider behind your CDN. Include issue and issuewild as needed. If your CA documents accounturi or validationmethods, add them. Empty or contradictory CAA after a migration is worse than intentional “no CAA yet.”
Quick publish triage
1) List every issuer that must keep working (Let’s Encrypt alone is fine for many sites). 2) Add matching CAA issue rows at @; add issuewild if you use *.example.com certs. 3) Wait for DNS TTL, then re-check with the free CAA checker. 4) Renew or force a test cert so ACME proves the allow-list. 5) Add the domain so CrowWake crows if CAA disappears after the next zone edit.
If CrowWake crows
No CAA → optional for tiny sites; publish when you care about issuance control. Present then gone → restore from your CA’s docs. CAA does not allow the live issuer → add an issue tag for that CA before the next renew. Certificate issuance failing after you added CAA → you forgot the CA your ACME client uses. After a fix, re-run the free CAA checker and confirm SSL expiry still looks healthy.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free CAA record checker with no login.
Deep dive: CAA monitoring — watch the allow-list so a silent wipe or live-issuer mismatch crows early, with the same free CAA record checker / CAA tester.
The free CAA record checker compares the allow-list to the live certificate issuer. Pair with the SSL expiry checker (same handshake, days + issuer). Guide: SSL certificate monitoring.