CAA Record
What a CAA Record Controls
A CAA record, short for certification authority authorization, lists which certificate authorities (CAs) are allowed to issue certificates for a domain. A CA is an organization that issues the digital certificates used to secure HTTPS connections. Other record types are summarized in DNS record types.
Without a CAA record, any publicly trusted CA may issue a certificate for the domain. With one, a CA that follows the industry rules checks the record first and refuses to issue if it does not list that CA. CAA therefore gives the domain owner a way to limit who can issue certificates in their name. A mistake in a CAA record can block certificate renewals, so the list should match the providers you actually use.
How CAA Tags and Lookup Work
Before issuing, a CA must check for CAA records. The lookup starts at the exact hostname and climbs to parent domains until it finds a CAA record. A CAA record at example.com therefore covers shop.example.com unless the subdomain has its own record.
Each entry has a flag, a tag and a value. The flag is almost always 0. Unlike a free-form TXT record, a CAA record uses a defined set of tags. The most common ones are:
- issue: names a CA allowed to issue certificates for the hostname.
- issuewild: names a CA allowed to issue wildcard certificates. If present, it applies to wildcards in place of the issue tag.
- iodef: gives a contact address or URL where the CA may report requests that break the policy.
A typical entry looks like this:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Using CAA Records Safely
A CAA record is a restriction, so it is easy to set too narrowly. If you list only one CA and later move to another, the new CA will refuse to issue until the record is updated. Keep the list in step with the providers you use, and remove entries for CAs you no longer use.
CAA is not a guarantee on its own. It relies on CAs checking the record before issuing, which compliant CAs must do. Because a forged DNS answer could in principle hide a CAA record, DNSSEC signing helps verify the answer.
Frequently asked questions
What Happens If a Domain Has No CAA Record?
Nothing breaks. Without a CAA record, any publicly trusted certificate authority may issue a certificate for the domain. Adding one is optional, but it is a simple way to limit issuance to the CAs you use.
Does a CAA Record Affect Certificates Already in Use?
No. CAA is checked when a certificate is issued or renewed. Adding or changing a CAA record does not revoke certificates that were already issued. If you remove a CA from the list, its existing certificates stay valid until they expire, but that CA will no longer issue replacements for them.