Best free CAA record generators
AdminKit's CAA record generator builds the issue, issuewild, iodef and critical-flag properties entirely in your browser, free with no account required; SSLMate's CAA Record Helper, ApiFreaks' CAA Records Generator and ShieldMarc's CAA Record Generator each build the same free, no-signup core text on their own pages, and two of the three also bundle a separate CAA checker.
AdminKit is built by Netbase JSC. AdminKit is listed below; SSLMate, ApiFreaks and ShieldMarc are independent and not affiliated with AdminKit.
What each tool’s own page confirms
SSLMate’s CAA Record Helper, read 2026-11-09, lets you check off the certificate
authorities you authorize and builds issue/issuewild properties plus an optional iodef reporting address, with
setup options including an empty policy, SSLMate-only authorization, or auto-generating a policy from Certificate
Transparency log data. It’s listed on SSLMate’s own free-tools page alongside two other
free tools, and its open-source GitHub repository documents output in five
DNS formats: generic, BIND zone file, legacy RFC 3597 hex, tinydns and dnsmasq.
ApiFreaks’ CAA Records Generator, read 2026-11-09, states
“Free, no sign-up. As many domains as you need,” and supports 60+ publicly trusted CAs with issue and issuewild
toggled separately per CA, an optional iodef field, and the same five output formats SSLMate’s helper documents.
ApiFreaks also runs a separate CAA Record Checker that “fetches
the records a domain already publishes and reports what they allow” — a tool AdminKit’s generator does not offer.
ShieldMarc’s CAA Record Generator, read 2026-11-09, states “100% free,
no sign-up needed” and lets you choose CAs for issue, with a “Same rules for wildcards” option covering
issuewild, plus an optional iodef email or HTTPS URL. Its own page explains the critical flag conceptually
(“A value of 128 sets the ‘critical’ flag…”) but does not confirm the generator itself lets you set it to anything
other than the default of 0, so this page marks that row unverified rather than assumed either way. ShieldMarc also
runs a separate CAA Checker to confirm published records.
AdminKit’s CAA record generator builds issue, issuewild, iodef and the critical flag
(flags byte 128, per RFC 8659 section 5.3) entirely in your
browser — its own tool page states plainly that nothing you enter is sent to AdminKit or anywhere else. None of the
other three tools’ own pages checked here confirm either way whether what you type leaves your browser.
Generator vs checker
A generator only builds record text; it has no way to know what a domain currently publishes. A checker queries DNS and reads back the live record. ApiFreaks and ShieldMarc each bundle both tools on the same site; SSLMate’s own free-tools listing names only the CAA Record Helper and two unrelated tools, with no CAA checker among them. AdminKit keeps the same split: the CAA record generator only builds text, and AdminKit’s DNS lookup is the tool that actually queries DNS and reads back what a domain publishes, including its CAA records.
The honest angle
If you want a generator that also supports auto-detecting CAs from Certificate Transparency logs and ships multiple output formats for less common DNS software, SSLMate’s own page and GitHub repository document the richest tooling here. If you want the generator and a matching checker on the same site with no account anywhere, ApiFreaks or ShieldMarc both document that pairing. AdminKit’s CAA record generator is the only one of the four whose own page states that nothing you type is sent to any server, and the only one that documents the critical flag as settable — but it has no bundled checker and only one output format, a zone-file-style block. Once you’ve built a record with any of these, confirm it actually published with a tool that queries DNS for real, such as AdminKit’s DNS lookup.
CAA is one of several DNS record types covered in AdminKit’s DNS cluster — see the CAA record glossary entry for the plain-language definition, the CAA records guide for what the record actually blocks, and the best free DNS lookup tools roundup for confirming any DNS record once it’s live.
Trademarks belong to their respective owners; AdminKit is not affiliated with SSLMate, Inc., ApiFreaks, or ShieldMarc.
| Feature | AdminKit | SSLMate | ApiFreaks | ShieldMarc |
|---|---|---|---|---|
| Free, no account required | ✓ | ✓ | ✓ | ✓ |
| Builds separate issue and issuewild properties (wildcard-specific authorization) | ✓ | ✓ | ✓ | ✓ |
| Builds an iodef violation-reporting property | ✓ | ✓ | ✓ | ✓ |
| States the critical flag (flags byte 128, RFC 8659 section 5.3) can be set | ✓ | — | — | — |
| Documented as running entirely in your browser, nothing sent to a server | ✓ | — | — | — |
| Also offers a free CAA record checker (reads back an existing record) on the same site | ✗ | ✗ | ✓ | ✓ |
| Outputs the record in more than one DNS zone/provider format | ✗ | ✓ | ✓ | — |
AdminKit vs SSLMate
Free, no account required
Builds separate issue and issuewild properties (wildcard-specific authorization)
Builds an iodef violation-reporting property
States the critical flag (flags byte 128, RFC 8659 section 5.3) can be set
Documented as running entirely in your browser, nothing sent to a server
Also offers a free CAA record checker (reads back an existing record) on the same site
Outputs the record in more than one DNS zone/provider format
AdminKit vs ApiFreaks
Free, no account required
Builds separate issue and issuewild properties (wildcard-specific authorization)
Builds an iodef violation-reporting property
States the critical flag (flags byte 128, RFC 8659 section 5.3) can be set
Documented as running entirely in your browser, nothing sent to a server
Also offers a free CAA record checker (reads back an existing record) on the same site
Outputs the record in more than one DNS zone/provider format
AdminKit vs ShieldMarc
Free, no account required
Builds separate issue and issuewild properties (wildcard-specific authorization)
Builds an iodef violation-reporting property
States the critical flag (flags byte 128, RFC 8659 section 5.3) can be set
Documented as running entirely in your browser, nothing sent to a server
Also offers a free CAA record checker (reads back an existing record) on the same site
Outputs the record in more than one DNS zone/provider format
Last checked
Sources: RFC 8659 — DNS Certification Authority Authorization (CAA) Resource Record, SSLMate — CAA Record Helper, SSLMate — Free Tools, SSLMate — caa_helper (GitHub repository), ApiFreaks — CAA Records Generator, ApiFreaks — CAA Record Checker, ShieldMarc — CAA Record Generator, ShieldMarc — CAA Checker
Frequently asked questions
Does this page rank SSLMate, ApiFreaks and ShieldMarc from best to worst, with AdminKit first?
No. AdminKit is listed alongside the other three tools, not placed first by default. The table below states only what each tool's own page confirms: all four build the issue, issuewild and iodef properties for free with no account; AdminKit's own tool page is the only one that states the critical flag is settable and that nothing you enter is sent to any server; ApiFreaks and ShieldMarc each bundle a separate CAA checker on the same site, which AdminKit and SSLMate do not. Which one fits depends on what you need, not a single ranking.
What's the difference between a CAA record generator and a CAA record checker?
A generator builds the text of a CAA record from the certificate authorities, wildcard rules and reporting address you choose — it has no idea what your domain currently publishes. A checker instead queries DNS and reads back whatever CAA records already exist for a domain. All four tools compared here are generators; ApiFreaks and ShieldMarc each also offer a separate checker tool on their own site, and AdminKit's separate DNS lookup tool reads back a domain's live CAA records.
Can any of these generators set CAA's critical flag?
Per AdminKit's own tool page, yes — it supports flags byte 128, which RFC 8659 section 5.3 defines as forcing a CA that doesn't recognize a property to refuse issuance outright rather than ignore it. None of SSLMate's, ApiFreaks' or ShieldMarc's own pages read for this comparison state that their generator lets you set that flag to anything other than its default of 0, so those three are marked unverified here rather than assumed to lack it.
Do any of these tools send what you type to a server?
AdminKit's own tool page states plainly that the record is assembled with JavaScript in your browser and nothing you enter is sent to AdminKit or anywhere else. SSLMate's, ApiFreaks' and ShieldMarc's own pages checked for this comparison don't say either way, so this page marks that row unverified for all three rather than assuming they do or don't round-trip through a server.
Which of these also lets me check an existing CAA record, not just build a new one?
ApiFreaks and ShieldMarc each do, as a separate tool on the same site: ApiFreaks' own CAA Record Checker page says it "fetches the records a domain already publishes and reports what they allow," and ShieldMarc's own CAA Checker page says to "Enter any domain below to check its CAA records." SSLMate's own free-tools page lists exactly three tools — CAA Record Helper, What's My Chain Cert? and CT Policy Analyzer — none of which reads back an existing CAA record. AdminKit's generator doesn't either; use AdminKit's DNS lookup tool for that.
Does this page use any competitor's logo or brand assets?
No. Every name here is used only to identify and compare publicly available tools (nominative use). AdminKit is not affiliated with or endorsed by SSLMate, Inc., ApiFreaks or ShieldMarc.
Want AdminKit to watch this for you?
Free checks tell you the state today. Protective DNS and monitoring tell you when it changes.