CAA Records

What It Does

Queries CAA records and parses the `issue`, `issuewild`, and `iodef` tags per RFC 8659, plus the RFC 8657 extensions `accounturi` and `validationmethods` for ACME account-binding. Tree-climbs to parent domains when no CAA is published on the queried name. Identifies authorized CAs against a curated registry of well-known identifiers (Let's Encrypt, DigiCert, Sectigo, Amazon ACM, Google Trust Services, etc.) and surfaces `unknown_issuer_identifiers` for typos — a typo silently allows ANY CA to issue, so this is a high-value safety check. Cross-references the CAA allowlist against Certificate Transparency logs (RFC 6962) via crt.sh: if a domain's CAA restricts issuance to LetsEncrypt but CT logs show a recent DigiCert cert, that's exactly the threat CAA was designed to detect. Verifies whether the zone is DNSSEC-signed (`dnssec_protected`) — without DNSSEC, an on-path attacker can spoof "no CAA" and CAs will treat the zone as permissive.

Why It's Useful

CAA only works if you keep it in sync with reality. Three failure modes cause real-world misissuance: (1) typo in the issuer identifier silently disables enforcement, (2) zone is unsigned so attackers can spoof "no CAA", (3) the policy is correct on paper but a different CA quietly issued anyway. EdgeDNS detects all three in one call. The CT cross-reference is the most security-impactful piece — most monitoring tools either check CAA or watch CT, not both.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/dns/caa" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/dns/caa?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/dns/caa',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.