{"uid":"cap_KGHCiITqetkH7iSLe4_aY","slug":"lookproof-caa-record-lookup-38b27264","name":"Lookproof CAA Record Lookup","description":"Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.","url":"https://api.lookproof.dev/v1/dns/caa?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Bikq1gWAFN5q7fphTdUw1","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Evaluate a domain's CAA (Certification Authority Authorization) DNS records, climbing to parent domains if needed, to determine which CAs may issue certificates and why certificate requests may be refused.","exampleAgentPrompt":"Check which certificate authorities are allowed to issue TLS certificates for stripe.com — including wildcard certs — and flag any invalid or unknown critical CAA tags that could block issuance.","exampleUseCases":[{"title":"Debugging a failed Let's Encrypt issuance","prompt":"My Let's Encrypt certificate request for api.mycompany.com keeps getting rejected. Can you check the CAA records for api.mycompany.com and tell me which CAs are actually allowed and whether there's anything blocking Let's Encrypt?"},{"title":"Pre-launch certificate authority audit","prompt":"Before we go live, check the CAA DNS records for shopfront.example.com — I need to know exactly which CAs are authorized to issue regular and wildcard certs, and whether there are any invalid or critical tags we should worry about."},{"title":"Multi-tenant SaaS CAA compliance check","prompt":"We're setting up certificates for a customer's domain customer-portal.acmecorp.io — can you look up its CAA records, including parent domain fallback, and tell me whether our CA is on the allowed list?"}],"resultDescription":"Returns the resolved CAA records for the domain (climbing to parent names if the queried name has none), including: list of allowed issuers for standard certificates (issue), allowed issuers for wildcard certificates (issuewild), iodef incident reporting addresses, any unknown critical tags, and any invalid or malformed CAA values that could interfere with certificate issuance.","failureModes":["Invalid or malformed domain name returns a validation error","Domain does not exist (NXDOMAIN) may return empty or error response","Network timeouts reaching upstream DNS resolvers","Rate limiting or payment failure (x402) if insufficient USDC balance","Upstream DNS resolver unavailable causing lookup failure"],"whenToPreferThis":"Use this endpoint when you specifically need to audit or debug CAA DNS policy for a domain — particularly to determine which CAs are permitted to issue TLS certificates, why a certificate request was rejected, or to verify CAA configuration before initiating a certificate order. Prefer this over general DNS lookup tools when you need RFC 8659-compliant CAA resolution with automatic parent-domain climbing and structured analysis of critical tags and invalid values.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:13.240Z","isFirstParty":false,"canonicalSlug":"lookproof-caa-record-lookup-38b27264"}