Enter the domain here and you'll get the records that apply, which CAs they allow, and any mistakes in them:
If you'd rather use the command line, read on. Just be aware that a plain lookup doesn't do everything a CA does, which is covered further down.
dig CAA example.com +short
That prints one record per line, for example:
0 issue "letsencrypt.org" 0 issuewild "letsencrypt.org" 0 iodef "mailto:security@example.com"
Leave off +short to see the full response, including the status line, which matters if something is wrong:
dig CAA example.com
To ask a particular resolver, or your own nameserver directly so you see changes before caches catch up, add it with @:
dig CAA example.com @1.1.1.1 dig CAA example.com @ns1.your-dns-provider.com
On Debian and Ubuntu, dig is in the dnsutils package (bind9-dnsutils on newer releases). It's already installed on macOS.
host -t CAA example.com
Gives a one-line answer per record, such as example.com has CAA record 0 issue "letsencrypt.org". It comes in the same package as dig.
nslookup -type=CAA example.com
On macOS and Linux this works, though some versions print the record type as a number, like rdata_257 = 0 issue "letsencrypt.org". 257 is the number for CAA.
Windows is awkward here. Depending on the version, the built-in nslookup and PowerShell's Resolve-DnsName either don't understand CAA or return it as raw data that's hard to read.
The easiest option, apart from the tester above, is to ask a public DNS-over-HTTPS service with curl, which comes with Windows 10 and 11:
curl.exe "https://dns.google/resolve?name=example.com&type=CAA"
The records are in the "data" fields of the "Answer" section. A "Status" of 0 means the lookup worked, and 2 means it failed (SERVFAIL). Use curl.exe rather than curl in Windows PowerShell, where curl is an alias for something else.
If you have WSL installed, dig works there as it does on Linux.
Each record is a flag, a tag and a value. 0 issue "letsencrypt.org" means flag 0, tag issue, and Let's Encrypt is allowed. Several lines are combined, so any CA listed can issue. The parts of a CAA record are explained in more detail on the about page, and there's a list of values for each CA.
No output doesn't mean no records. A CA that finds nothing on shop.example.com goes on to check example.com, and uses the records there. dig only looks at the exact name you give it, so check each parent as well:
dig CAA shop.example.com +short dig CAA example.com +short
+short hides failures. If the lookup fails with SERVFAIL, dig +short prints nothing at all, which looks exactly like having no records. A CA treats it very differently and refuses to issue. Run it without +short and look for status: SERVFAIL. If adding +cd makes it work, the problem is DNSSEC. The troubleshooting guide covers what to do next.
CNAMEs are followed. If the name is a CNAME, the full dig output shows the CNAME and then the target's CAA records, and those are the ones the CA uses:
www.example.com. 300 IN CNAME example.net. example.net. 300 IN CAA 0 issue "digicert.com"
Caches lag behind. Your resolver may still have the old records until their TTL runs out, and CAs can reuse a lookup for up to 8 hours. Query your nameserver directly with @ to see what's actually published.
The tester on this site follows parent domains and CNAMEs and reports lookup failures, so it gives you the same answer a CA would get.