CAA Certification Authority Authorization

CAA records control which certificate authorities may issue TLS/SSL certificates for your domain. Learn the tags, flags, and how to combine entries.

Published · Last verified · Maintained by TamingDNS

Record Type
CAA
Category
Security
RFC
RFC 8659
Email Relevant
Indirect
Format
CAA <flags> <tag> "<value>"
Example
CAA 0 issue "letsencrypt.org"
TTL Guidance
3600-86400 s; CAs check this before issuance so changes propagate before requesting a cert

💬 What This Record Does

CAA (Certification Authority Authorization) records let you restrict which certificate authorities (CAs) are allowed to issue TLS/SSL certificates for your domain. Before issuing a certificate, compliant CAs must check for CAA records and refuse to issue if they are not listed. If no CAA records exist, any CA can issue certificates. Three tags are defined: "issue" (allow DV and OV certs), "issuewild" (allow wildcard certs), and "iodef" (receive violation reports via email or URL).

Common Uses

  • Restricting certificate issuance to a single CA (e.g., only Let's Encrypt)
  • Preventing misissued certificates by unauthorised CAs
  • Receiving alerts if a CA attempts to issue a certificate that violates your CAA policy

⚠️ Watch Out For

  • A domain with only an "issue" record (and no "issuewild") still allows any CA to issue wildcard certs. Add "issuewild" explicitly to restrict wildcards.
  • CAA is checked by compliant CAs, but a compromised or rogue CA might not honour it.
  • You can have multiple CAA records on the same name, one per allowed CA.

🔧 Related Tools

DNS Lookup → DNSSEC →

📋 Complete Example Records

Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool. 

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Only one authority may issue for this name. A CA following the standard checks the record before issuing and refuses if it is not listed.

example.com.  3600  IN  CAA  0 issue "digicert.com"
example.com.  3600  IN  CAA  0 issue "globalsign.com"
example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Three authorities on one name. Each permitted CA needs a record of its own, and the permissions are additive.

example.com.  3600  IN  CAA  0 issue "ca1.example.net"
example.com.  3600  IN  CAA  0 issuewild "ca2.example.org"

From RFC 8659 §4.3. The first covers ordinary names, the second covers wildcards, and once an issuewild is present it takes precedence for wildcard requests.

nocerts.example.com.  3600  IN  CAA  0 issue ";"

A bare semicolon forbids issuance entirely. RFC 8659 §4.2 uses it for names that should never have a certificate.

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

Adding a reporting address. A CA that receives a request breaching the policy can then tell you about it.

📚 References

↗RFC 8659: DNS Certification Authority Authorization

🔗 Related Record Types

TLSA
TLS Authentication (DANE)
 NS
Name Server
← All DNS Record Types