CAA Record (Certification Authority Authorization)

A CAA (Certification Authority Authorization) record lets a domain owner declare which certificate authorities are permitted to issue certificates for that domain. It is defined in RFC 8659.

Why it matters

Public CAs are required by the CA/Browser Forum rules to check CAA before issuing a certificate and to refuse if they are not listed. This limits the damage from a mistaken or fraudulently validated request at some other CA. The flip side is that a restrictive CAA record can block your own certificate renewals if you forget it exists.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

This allows only Let's Encrypt for normal certificates, forbids wildcard issuance, and asks CAs to report problems by email. Check with dig example.com CAA. CAs look up the tree, so a record at the apex also covers subdomains unless one is set closer.

Common mistakes

• Adding a CAA record for one CA, then switching hosting or CDN providers whose CA is not listed, and watching renewals fail.
• Forgetting issuewild rules, which control wildcard certificates separately.
• Putting a CAA record under a name that is a CNAME to a provider whose CAA differs.
• Treating CAA as encryption or access control. It guards issuance only, not browsers.

Related

• Certificate authority
• Wildcard certificate
• SSL/TLS
• Guide: Let's Encrypt renewal failures
• Tool: SSL checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.