netlupaLook up a domain's CAA records
CAA records limit which authorities may issue SSL certificates for a domain. Enter the domain to see them.
What is a CAA record?
The CAA (Certification Authority Authorization) record says which certificate authorities may issue certificates for the domain, for example “0 issue "letsencrypt.org"”. Before issuing a certificate, authorities must check it and refuse if they are not listed.
If a domain has no CAA records, any authority may issue certificates for it. If your certificate renewal fails, check that your current provider is on the list.
Lookups by record type
Frequently asked questions
What do issue and issuewild mean?
“issue” allows an authority to issue regular certificates and “issuewild” wildcard certificates (*.example.com). “iodef” says where to report an attempt to issue an unauthorized one.
How long does a DNS change take to propagate?
As long as the old record's TTL: from a few minutes to 24 or 48 hours. Nameserver (NS) changes usually take longer, because the TTL of the delegation in the TLD is high.
What does NXDOMAIN mean?
That the name you looked up does not exist in DNS: the domain is not registered, has expired or was mistyped.
Which DNS servers does this tool ask?
No middleman: Netlupa runs its own resolver, which starts from the root servers and asks each domain's official DNS servers directly.
Can I do a reverse DNS lookup of an IP?
Yes: look the IP up with the API (/api/dns/ptr/8.8.8.8) or use the WHOIS tool to find out who it belongs to.
Why do I see a different value than in my DNS panel?
Because resolvers still have the previous value cached. Wait for the time shown in the TTL, or check that you edited the zone at the provider listed in the NS records: if the domain uses other DNS servers, changes in your panel have no effect.
What is a record's TTL?
The time, in seconds, other servers may keep the answer before asking again. 3600 is one hour. A low TTL makes changes show up sooner, at the cost of more queries.