{"uid":"cap_J9eihJMLNE86i-cPjsNK-","slug":"caa-record-lookup-for-domain-8a9afe48","name":"CAA Record Lookup for Domain","description":"CAA records for a domain (walking up to parent names): which CAs may issue certificates, wildcard rules and reporting contacts.","url":"https://domain-dns.x402tookit.com/caa-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain name, e.g. cloudflare.com"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"asOf":{"type":["null","string"]},"iodef":{"type":["array","null"],"items":{"type":"string"}},"domain":{"type":["null","string"]},"source":{"type":["null","string"]},"foundAt":{"type":["null","string"]},"reasons":{"type":["array","null"],"items":{"type":"string"}},"records":{"type":["array","null"],"items":{"type":"object","properties":{"tag":{"type":["null","string"]},"flag":{"type":["null","number"]},"value":{"type":["null","string"]}}}},"summary":{"type":["null","string"]},"verdict":{"type":["null","string"]},"degraded":{"type":["boolean","null"]},"sourceUrl":{"type":["null","string"]},"disclaimer":{"type":["null","string"]},"notChecked":{"type":["array","null"],"items":{"type":"string"}},"allowedIssuers":{"type":["array","null"],"items":{"type":"string"}},"allowedWildcardIssuers":{"type":["array","null"],"items":{"type":"string"}}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_f9-6uv_i4X5w43OqlzuVS","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Retrieves CAA (Certification Authority Authorization) DNS records for a domain, walking up to parent names, to show which CAs may issue certificates, wildcard rules, and reporting contacts.","exampleAgentPrompt":"Can you check the CAA records for cloudflare.com and tell me which certificate authorities are allowed to issue SSL certificates for it, including any wildcard rules?","exampleUseCases":[{"title":"Pre-issuance CA authorization check","prompt":"Before I request a TLS certificate from Let's Encrypt for api.mycompany.com, can you check the CAA records and confirm whether Let's Encrypt is actually authorized to issue for that domain?"},{"title":"Security audit of certificate policy","prompt":"I'm auditing our domain security — can you look up the CAA records for acmecorp.com, walk up to the parent if needed, and give me a summary of which CAs are allowed, whether wildcards are permitted, and where incident reports should go?"},{"title":"Diagnosing certificate issuance failures","prompt":"Our SSL certificate renewal for shop.example.co.uk keeps failing — can you check the CAA records for that domain and tell me what the current policy says and which CA is permitted to issue?"}],"resultDescription":"Returns a structured object including the list of allowed certificate issuers, allowed wildcard issuers, iodef reporting contacts, individual CAA record entries (tag, flag, value), the domain level where the records were found (foundAt), a human-readable summary and verdict, a degraded flag if data quality is uncertain, the source/resolver used, and a timestamp (asOf).","failureModes":["Domain does not exist or has no DNS records — returns empty or null records with an explanatory verdict","Network or resolver timeout — may return degraded=true with partial data","Invalid domain input (malformed string) — likely returns an error or empty result","Domain has no CAA records at any level — returns empty allowedIssuers with summary indicating no restriction","Rate limiting or payment failure — 402 response requiring valid x402 payment"],"whenToPreferThis":"Choose this endpoint when you specifically need CAA DNS record data for a domain, including parent-level inheritance, wildcard issuance rules, and iodef contacts. It is ideal for pre-certificate-issuance checks, PKI security audits, or diagnosing CA authorization failures. Prefer it over a generic DNS lookup when you need the CAA-specific parsed output (allowed issuers, wildcard issuers, verdict) rather than raw record text.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T18:50:34.461Z","isFirstParty":false,"canonicalSlug":"caa-record-lookup-for-domain-8a9afe48"}