Certificate issuance policy

Find the closest published CAA record set that applies to a domain. Checks begin at the exact name and walk up its DNS name hierarchy, stopping at the first set found.

The queried names are sent directly to Cloudflare's public DNS-over-HTTPS resolver. EZ Tools does not proxy or save them. This is a DNS lookup, not a certificate-authority issuance decision. Cloudflare resolver privacy details.