CAA Records Explained: Controlling Who Can Issue Certificates for Your Domain

What a CAA Record Does

CAA (Certification Authority Authorization) is a DNS record that specifies which certificate authorities are permitted to issue TLS certificates for your domain. Before issuing a certificate, a compliant CA is required to check for a CAA record and refuse to issue if your domain hasn’t authorised them.

Without a CAA record, any publicly trusted CA can issue a certificate for your domain if they’re tricked or fail to verify properly – a CAA record removes that ambiguity entirely by giving one explicit allowlist.

A Basic Example

example.com. CAA 0 issue "letsencrypt.org"

This says: only Let’s Encrypt is authorised to issue standard certificates for this domain. A request to any other CA – even a well-known one – should be refused.

Breaking Down the Fields

• Flag (0) – 0 means non-critical, so CAs that don’t understand a given tag should just ignore it rather than refuse issuance. A flag of 128 marks the tag as critical.
• Tag – what kind of authorisation this is: issue (standard certificates), issuewild (wildcard certificates specifically), or iodef (where to report policy violations).
• Value – the authorised CA’s domain, or a report destination for iodef.

Allowing Multiple CAs

example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issue "pki.goog"
example.com. CAA 0 issuewild "letsencrypt.org"

Here, both Let’s Encrypt and Google Trust Services can issue standard certificates, but only Let’s Encrypt is authorised for wildcards. This is useful if you know exactly which providers your infrastructure uses – an ACME client hitting Let’s Encrypt for your web server, say, and a managed load balancer using Google’s CA – and want to block issuance from anyone else, deliberate or accidental.

Getting Violation Reports

example.com. CAA 0 iodef "mailto:security@example.com"

This asks CAs to notify you if they receive (and decline) an unauthorised issuance request for your domain – an early warning if someone is attempting to get a fraudulent certificate issued.

Restricting Issuance Entirely

If you never issue publicly trusted certificates for a domain – an internal-only subdomain, for instance – you can block issuance outright:

internal.example.com. CAA 0 issue ";"

The semicolon value means “no CA is authorised,” which is a deliberate statement rather than an oversight, and stops anyone from ever getting a valid public cert issued for that name.

Why This Is Worth Setting Up

CAA doesn’t stop attacks that don’t go through the CA at all – a compromised private key is a different problem – but it does close off certificate misissuance: a CA misconfiguration, a social-engineering attempt, or an automated system incorrectly validating domain control for someone else. It’s a low-effort record that removes an entire category of risk, and unlike MTA-STS or DNSSEC there’s no ongoing operational overhead once it’s set.

Last in this series: the A record itself, the most fundamental DNS record type that everything else in this list ultimately points back to.