DE

↑ ↓ select, Enter open, Esc close

Check the CAA record of a domain

harmlessDNSdebian, ubuntu
Adjust the values, the command updates live
user@server
dig +short example.com CAA

Prints the CAA records that define which certificate authorities may issue certificates for the domain. If a CAA record exists without letsencrypt.org, Let’s Encrypt refuses to issue. Empty output means any certificate authority may issue.

Note: If a subdomain has no CAA record, the record of the parent domain applies.

Also searched as

  • let's encrypt fails caa record
  • which ca is allowed to issue certificates
  • check caa dns record

Related one-liners

All in DNS

Check a domain's DKIM key in DNS

$dig +short default._domainkey.example.com TXT
harmlessDNS

Check DNS propagation across public resolvers

$for ns in 1.1.1.1 8.8.8.8 9.9.9.9 208.67.222.222; do echo "$ns: $(dig +short @$ns example.com A | tr '\n' ' ')"; done
harmlessDNS

Check if a server IP is on the Spamhaus blacklist

$dig +short $(echo 203.0.113.10 | awk -F. '{print $4"."$3"."$2"."$1}').zen.spamhaus.org
harmlessDNS

Check whether DNSSEC works for a domain

$dig @1.1.1.1 +dnssec example.com SOA | grep -E "flags:|RRSIG|status:"
harmlessDNS

Compare the SOA serial on all nameservers

$for ns in $(dig +short example.com NS); do echo "$ns $(dig +short @$ns example.com SOA | awk '{print $3}')"; done
harmlessDNS

Look up the MX records of a domain

$dig +short example.com MX
harmlessDNS

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.