DNSlens

CAA checker

A CAA record names the certificate authorities allowed to issue for a domain. CAs are required to check it, and they check the parents too — so the policy that governs a host is often published several labels above it.

A CA checks the name and then every parent, using the first set it finds. DNSLens climbs the same way and shows which name the answer came from.

Try one of these