Domains and DNS

What is a CAA record?

Any certificate authority in the world can issue a certificate for your domain unless you say otherwise, and a CAA record is how you say otherwise.

A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are permitted to issue SSL/TLS certificates for your domain. Every publicly trusted CA is required to look up the domain’s CAA records before issuing, and to refuse if it is not on the list. A typical record looks like example.com. CAA 0 issue "letsencrypt.org". If a domain has no CAA record at all, any CA may issue, which is the default for the vast majority of domains.

Worked out 2026-10-16 (IST) · CAA as specified in RFC 8659 and enforced under the CA/Browser Forum Baseline Requirements

Anatomy of a CAA record

Three fields after the type
Field	Example	Meaning
Flag	0	Almost always 0. The value 128 marks the record as critical, so a CA that does not understand the tag must refuse to issue
Tag	issue	issue, issuewild or iodef
Value	"letsencrypt.org"	The CA’s identifier, in quotes. A lone ";" means "no CA is permitted"

The three tags

What each tag does
Tag	Purpose	Example
issue	Which CA may issue ordinary certificates	CAA 0 issue "letsencrypt.org"
issuewild	Which CA may issue wildcard certificates	CAA 0 issuewild ";"
iodef	Where a CA should report a request that violated the policy	CAA 0 iodef "mailto:security@example.com"

How a CA checks it

Before issuing for www.example.com, the CA looks for a CAA record on that exact name. If there is none, it climbs one label at a time - example.com, then the top-level domain - and uses the first CAA record set it finds. Because of that, a single record on the apex covers every subdomain beneath it unless a subdomain publishes its own. Under the CA/Browser Forum Baseline Requirements this check has been mandatory for every publicly trusted CA since 8 September 2017.

Common CA identifiers

Check your CA’s documentation for the exact value
Certificate authority	Identifier used in CAA
Let’s Encrypt	letsencrypt.org
DigiCert	digicert.com
Sectigo	sectigo.com
Google Trust Services	pki.goog
Amazon (ACM)	amazon.com or amazontrust.com

A safe setup, step by step

Order matters
Step	What to do
1	Find out which CAs currently issue for the domain: check the certificate on every subdomain, including mail and API hosts
2	Add one issue record per CA you use, and one issuewild record if you use wildcards
3	Add an iodef record with a monitored address so violations reach someone
4	Test by requesting or renewing a certificate with each CA before relying on the policy

A CAA record is one of several checks worth running when a certificate behaves strangely. For the browser-side symptoms see why an SSL certificate is not trusted, and for renewal timing see how long an SSL certificate is valid.

Sources: IETF RFC 4033, RFC 4034 and RFC 4035 (DNSSEC), RFC 8659 (DNS Certification Authority Authorization), and the CA/Browser Forum Baseline Requirements, which have required certificate authorities to check CAA records before issuing since 8 September 2017.

Check your own numbers

Look up the CAA records published for a domain, and check the certificate it currently serves.

DNS LookupA, AAAA, MX, NS, TXT, CNAME and SOA records, live from the resolver.

Frequently asked

Is a CAA record required?

No. Without one, every public CA is allowed to issue for your domain. A CAA record is a restriction you opt into, not a requirement, which is why most domains have none. It becomes worth adding once you know which one or two CAs you actually use.

Will adding a CAA record break my existing certificate?

No. CAA is checked only at the moment of issuance or renewal, not when a visitor connects, so a certificate already issued keeps working. The risk is at renewal: if your CAA record names the wrong CA, the next automatic renewal will be refused and the certificate will expire. Confirm the CA’s exact CAA identifier before adding anything.

What is the difference between the issue and issuewild tags?

The issue tag controls ordinary certificates, and issuewild controls wildcard certificates (see <a href="/answers/what-is-a-wildcard-ssl-certificate/">wildcard certificates</a>). If issuewild is absent, the issue tag governs wildcards too. Setting issuewild ";" while allowing issue for a named CA is the usual way to forbid wildcards entirely.

Do CAA records protect against a hacked certificate authority?

Only partly. CAA stops an honest CA from issuing for a domain that has not authorised it, which blocks mistakes and some attacks. It cannot stop a CA that ignores the check or a CA whose systems have been compromised. It reduces the number of organisations you have to trust; it does not reduce it to zero.

Need domain and DNS checks inside your own product?

We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.