DNS CSVdns-csv.com
CAA issuance policy and HTTPS records

CAA & HTTPS
inventory

See CAA records that name which certificate authorities may issue for the domain, and HTTPS records (DNS type 65) published at the names this inventory probes.

The tool shows what DNS publishes. It does not ask a certificate authority whether a certificate was issued, and it does not scan TLS certificates. Free is 3 lookups a day.

Custom hostnames

Optional. One per line, or separated by commas or spaces. A bare label is probed under the domain you look up (staging → staging.example.com). A full name must belong to that domain — names outside it are skipped.

Leave blank to probe only the built-in common hosts and mail-auth names.

Lookup mode

Multi-domain lookup is included on paid plans.
AAAAACNAMEMXNSTXTSOASRVCAAHTTPS
DNS-over-HTTPSCSV · JSON · XMLInstant resultsCustom hostnames

Simple, transparent pricing

Free is 3 browser lookups a day. Paid plans add the API and saved scan history. Growth and Scale add scheduled monitoring.

Save 20% annually

Free

$0

No credit card required

Get started with no commitment

  • 3 browser lookups / day
  • All record types (A, MX, TXT…)
  • CSV, JSON, XML export
  • Unlimited browser lookups
  • API access
  • Scan history
  • Scheduled cron jobs

Pro

$9.99/mo

Billed monthly

For individuals and small teams

  • Unlimited browser lookups
  • All record types (A, MX, TXT…)
  • CSV, JSON, XML, PDF export
  • 1,000 API lookups / month
  • Bulk lookup (10 domains)
  • 30-day scan history
  • Scheduled cron jobs
Most popular

Growth

$49.99/mo

Billed monthly

For growing teams and automation

  • Unlimited browser lookups
  • All record types (A, MX, TXT…)
  • CSV, JSON, XML, PDF export
  • 10,000 API lookups / month
  • Bulk lookup (50 domains)
  • 90-day scan history + diff view
  • 5 scheduled cron jobs

Scale

$199.99/mo

Billed monthly

For high-volume and enterprise use

  • Unlimited browser lookups
  • All record types (A, MX, TXT…)
  • CSV, JSON, XML, PDF export
  • 100,000 API lookups / month
  • Bulk lookup (100 domains)
  • 365-day scan history + diff view
  • 25 scheduled cron jobs

All plans include DNS-over-HTTPS queries. No credit card required for Free.

What CAA and HTTPS rows mean

CAA is queried on the apex and on common hosts that are not answered by a CNAME. A CAA value is the published policy returned by DNS-over-HTTPS, such as issue, issuewild, or iodef. No CAA row means none of the probed names returned a CAA record.

HTTPS records are DNS type 65. The inventory queries HTTPS and does not send a separate SVCB query. When a name is a CNAME, you see the CNAME, not an HTTPS record that might exist at the target.

Both types export with the rest of the inventory. Filter the table to CAA or HTTPS before downloading if you want only those rows. Provenance is stored on every row, including these.

Questions

Does a missing CAA record mean any CA can issue?
This page reports whether a CAA record was returned for the apex and the other names it probed. It does not decide what an empty CAA set allows. That interpretation depends on the CA policy you rely on.
Do you check the live certificate?
CAA and HTTPS here are DNS lookups. The page does not connect to port 443, download a certificate, or contact a certificate authority.
Why is HTTPS missing when the site loads in a browser?
A website can use TLS without publishing an HTTPS DNS record. The HTTPS row is DNS type 65, not a test of whether the site responds on port 443.
Are CAA and HTTPS in the CSV?
They are included when the lookup returned them. Filter to CAA or HTTPS to export those rows. Columns include TTL and provenance.

Other lookups