Choose the right CAA property
Use issue to authorize ordinary certificate issuance and issuewild for wildcard certificates. An empty issuer value can explicitly deny issuance for that property. Use iodef only as a reporting contact; it does not authorize a certificate authority.
Check CAA before a certificate change
Query the exact hostname and its parent domain because certificate authorities can inherit CAA policy through the DNS hierarchy. Confirm that the intended certificate authority is listed, publish the change before renewal or migration, and allow resolver caches to expire.
Check real data now
Use the live IIPP tool to inspect the domain or IP address you are working with.
DNS Record Lookup →