What CAA Does
CAA (Certification Authority Authorization) is a DNS record type that names the certificate authorities (CAs) allowed to issue TLS certificates for a domain. Publicly trusted CAs are required to check CAA records before issuing a certificate. If your record does not list them, they must refuse.
This protects against certificates being issued for your domain by a CA you do not use — for example through a mistake or a compromised account at another provider.
Syntax
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issuewild ";"
example.com. CAA 0 iodef "mailto:security@example.com"- issue – which CA may issue normal certificates.
- issuewild – which CA may issue wildcard certificates.
";"means none. - iodef – where CAs can report requests that violate the policy.
- The leading
0is a flags field; leave it at 0.
Add one issue line for each CA you use.
How CAs Find Your CAA Record
A CA checks the exact name in the certificate first, then walks up the tree: for shop.example.com it checks shop.example.com, then example.com. A record on the root domain therefore covers all subdomains unless a subdomain has its own CAA record. No CAA record anywhere means any CA may issue.
Before You Add One
- List every certificate in use: the website, mail server, CDN, load balancer and any SaaS services using your subdomains (help desks, shops, landing pages).
- Find out which CA issues each. CDNs often use several CAs and document the values to allow.
- Add
issuelines for all of them.
Common Mistakes
- Forgetting the CDN’s CA: automatic certificate renewal at the CDN fails weeks later, when the old certificate expires.
- Blocking wildcards accidentally: if you use a wildcard certificate, allow it with
issuewild. - CAA on a subdomain with a CNAME: CAs follow the CNAME and may find the target’s CAA policy instead of yours.
Checking
Look up CAA records with our DNS Record Lookup. After adding a record, wait until resolvers see it — see DNS TTL — before renewing certificates.