CAA Record Check
Query and parse a domain's CAA records: which certificate authorities are authorized to issue TLS certificates, whether wildcards are covered separately, and where violation reports go. A CAA policy locks the domain against mis-issuance by CAs the owner never chose.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
GET /api/v1/security/caa-check?domain=google.com
Result: google.com restricts issuance to: pki.goog
Cloudflare-protected
GET /api/v1/security/caa-check?domain=cloudflare.com
Result: cloudflare.com restricts issuance to: comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org, pki.goog; cansignhttpexchanges=yes, ssl.com (wildcards: comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org, pki.goog; cansignhttpexchanges=yes, ssl.com)
No CAA
GET /api/v1/security/caa-check?domain=example.org
Result: example.org has no CAA record — any CA on the public WebPKI list may issue certificates for it
Machine API (x402)
$0.02 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/caa-check?domain=google.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/caa-check",
"input": {"domain":"google.com"},
"result": { "value": 1, "answer": "google.com restricts issuance to: pki.goog" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Reads the CAA policy that decides which certificate authorities can issue for a domain — the least-known but most effective control against certificate mis-issuance. Reports issue/issuewild/iodef tags exactly as receivers apply them, live from DNS.
Frequently asked questions
How does CAA actually protect me?
CAs are required to check CAA before issuing. If a CA not in your CAA list receives a request (fraudulent or buggy), it must refuse — a fail-safe that has blocked real mis-issuance incidents.
What's the difference between issue and issuewild?
issue authorizes normal certificates, issuewild wildcard ones (*.domain). If issuewild exists it exclusively governs wildcards — handy to allow one CA for normal certs and none for wildcards.