CAA Record (Certification Authority Authorization)

A CAA (Certification Authority Authorization) record lets a domain owner declare which certificate authorities are permitted to issue certificates for that domain. It is defined in RFC 8659.

Why it matters

Public CAs are required by the CA/Browser Forum rules to check CAA before issuing a certificate and to refuse if they are not listed. This limits the damage from a mistaken or fraudulently validated request at some other CA. The flip side is that a restrictive CAA record can block your own certificate renewals if you forget it exists.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

This allows only Let's Encrypt for normal certificates, forbids wildcard issuance, and asks CAs to report problems by email. Check with dig example.com CAA. CAs look up the tree, so a record at the apex also covers subdomains unless one is set closer.

Common mistakes

• Adding a CAA record for one CA, then switching hosting or CDN providers whose CA is not listed, and watching renewals fail.
• Forgetting issuewild rules, which control wildcard certificates separately.
• Putting a CAA record under a name that is a CNAME to a provider whose CAA differs.
• Treating CAA as encryption or access control. It guards issuance only, not browsers.

Related

• Certificate authority
• Wildcard certificate
• SSL/TLS
• गाइड: Let's Encrypt renewal failures
• टूल: SSL checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.