See which certificate authorities a domain allows to issue its SSL certificates
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 25 Oct 2026.CAA records name the certificate authorities allowed to issue certificates for a domain, and every public CA has had to check them before issuing since September 2017 (RFC 8659). Type the domain to see each record split into flags, tag and value: issue, issuewild for wildcard certificates, and iodef for where refusals are reported.
Leave Record type on CAA, which this page selects when it opens.
Type the domain, such as google.com, and press Look up.
Read each record split into flags, tag and value: issue, issuewild or iodef.
If the result says No records, any certificate authority may issue; press Copy records to keep what you found.
No CAA record at all means any CA may issue, which is the default.
This DNS lookup asks a public resolver, Cloudflare 1.1.1.1 or Google 8.8.8.8, the same question dig or nslookup would, and shows the answer in a table. Pick one record type, or "All common types" to ask for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and HTTPS together. Every record shows its TTL in seconds and in words, because the TTL is how long any copy of it may be cached.
The records that are hard to read by eye are split into labelled fields. An SOA becomes its primary server, the contact mailbox, the serial and four timers. A CAA record becomes flags, tag and value. An SRV record becomes priority, weight, port and target, with the service named from the record's own name. DS and DNSKEY records show the algorithm by name, and the key tag of each DNSKEY is worked out so you can match it against the DS record at the parent.
A browser cannot send DNS packets itself, so the page uses DNS over HTTPS. The name you type goes to the resolver you chose, which is how it gets an answer; nothing else about you or your other searches is sent. You see what that resolver has in its cache, which can lag a recent change by up to the record's TTL. To compare two resolvers side by side, use the DNS Propagation Checker.
The rest of the article, and all 6 questions about DNS Lookup, are on the DNS Lookup page.
Only the name and the record type, sent from your browser to the resolver you chose: Cloudflare at cloudflare-dns.com or Google at dns.google. The resolver needs them to answer. Nothing else leaves your device, and this site never sees the names you type.
NXDOMAIN is the DNS answer for a name that does not exist at all, for any record type. Common causes are a typo, a subdomain that was never created, or a domain that has expired. A name that exists but lacks the type asked for gets a different answer: no records.
SERVFAIL means the resolver tried and could not get a trustworthy answer. Either the domain's own name servers did not reply, or the answer failed DNSSEC validation. The DNS Propagation Checker asks again with DNSSEC checking off, which shows which of the two it is.
No. DNS answers questions about names you already know; there is no query that lists every name in a zone, and zone transfers are refused by almost every public server. Certificate transparency logs are the usual way to discover subdomains, and this tool does not search them.
Still stuck? Ask about DNS Lookup and anybody who knows can answer. No account needed.
Same job, other tools: Open Port Checker – See if a port forwarded on your router is reachable from the internet · AS Number Lookup – Turn an AS number into the network name, registry and allocation date · IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix.