All tools

DNS CAA Record Builder / Validator

Network

Build a Certification Authority Authorization (CAA) DNS record from a tag and domain, or parse an existing zone-file record into its flags, tag, authorized domain, and parameters

A CAA record tells certificate authorities which of them, if any, are allowed to issue certificates for your domain, closing the gap where any public CA could otherwise issue a cert for a name it was never asked to. This tool builds a correctly formatted record from a tag (issue, issuewild, iodef, or issuemail) and an authorized CA domain, including the disallow-all form that blocks every CA, or parses an existing record string back into its flags, tag, domain, and any validationmethods/accounturi parameters. It works entirely on the text you give it: there's no live DNS query, so you still need to publish the result through your own zone file or DNS provider.

dnscaacertificate-authoritysslsecurityzone-file

How to use DNS CAA Record Builder / Validator

  • 1.Pick a tag (issue for single-domain certs, issuewild for wildcard certs, iodef to name a contact for violation reports) and enter the CA's domain, e.g. letsencrypt.org.
  • 2.Toggle "Disallow all issuance" to build the record that blocks every CA from issuing for this domain, or "critical" to set the flags bit that tells unaware CAs to refuse issuance rather than ignore the record.
  • 3.Paste an existing CAA record string into the parser to see its tag, authorized domain, and any extra validationmethods or accounturi parameters broken out.

Frequently asked questions

Does this query my domain's actual DNS records?
No, it only builds or parses the record text you give it; publishing the result still requires adding it to your zone file through your DNS provider.
What's the difference between issue and issuewild?
issue authorizes a CA to issue any certificate including wildcards unless an issuewild record also exists, in which case issuewild takes precedence specifically for wildcard certificates.
What does the critical flag actually do?
Setting flags to 128 tells a CA that doesn't recognize the record's tag that it must refuse to issue rather than silently ignore the restriction, per RFC 8659.
Can I block all certificate issuance for a domain?
Yes, build an issue record with the domain left empty (or "Disallow all issuance" checked), which produces the value ";" meaning no CA is authorized.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/dns-caa-record \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"tag":"issue","domain":"letsencrypt.org","params":[{}],"raw":"0 issue \"letsencrypt.org; validationmethods=dns-01\""}'

Get an API key from your dashboard · Full API docs →

Related tools

SSL Certificate CheckerInspect SSL/TLS certificates: expiry, issuer, SANs, and fingerprint for any domainNetworkAWS IAM Policy Explainer (AI)Paste an AWS IAM policy document and get a plain-English, statement-by-statement walkthrough plus a list of concrete issues worth fixing, powered by GPT-4o miniCodeClear-Site-Data Header BuilderBuild a Clear-Site-Data response header from cache, cookies, storage, and executionContexts directives (or * for all of them), or parse an existing header back into its directivesNetwork