CAA Records: Controlling Which CAs Can Issue Certificates for Your Domain

A CAA (Certification Authority Authorization) record lets you specify exactly which certificate authorities are allowed to issue SSL/TLS certificates for your domain — and CAs are required to check it before issuing. It is a simple DNS record that meaningfully reduces the risk of an unauthorised or mis-issued certificate.

What problem it addresses

By default, many public CAs can issue a certificate for any domain if someone passes their validation. A CAA record narrows that: it publicly states "only these CAs may issue for me", and compliant CAs must honour it, refusing to issue if they are not listed. It is a guardrail against mis-issuance. It pairs naturally with your SSL certificate setup.

How a CAA record looks

A CAA record has a flag, a tag, and a value. The common tags:

• issue — authorise a CA to issue standard certificates.
• issuewild — authorise (or restrict) wildcard certificate issuance specifically.
• iodef — an address for CAs to report policy-violation attempts to.

yourdomain.com. CAA 0 issue "letsencrypt.org"

This authorises Let's Encrypt to issue for the domain. List each CA you use; if you use several, add a record for each.

Getting it right

• Include every CA you actually use — otherwise a renewal or new issuance could be blocked. If you use Let's Encrypt and another CA, list both.
• Consider issuewild if you want to restrict wildcard certificates separately.
• Set an iodef address to be notified of attempted violations.
• Remember inheritance — CAA applies down the tree, so a record at your domain covers subdomains unless overridden.

Verify it

Check your CAA with dig CAA. If certificate issuance suddenly fails, a missing or wrong CAA record is a prime suspect — see fixing common SSL errors.

Frequently asked questions

Does a CAA record improve my site's encryption?

No — it does not change encryption strength. It controls who can issue certificates for your domain, reducing the risk of an unauthorised certificate. It is a governance control, not an encryption setting.

Will a CAA record block my own certificate renewals?

It will if you forget to list the CA you use. Always include every CA involved in issuing or renewing your certificates, or a renewal could be refused. Add each as its own issue record.

Do I need CAA on every subdomain?

Not usually — CAA is inherited down the tree, so a record at your domain covers subdomains unless a subdomain has its own CAA. You can override at a specific subdomain if you need different rules there.