Glossary

CAA Record

Controls which certificate authorities can issue SSL/TLS certificates for a domain

A CAA record (Certification Authority Authorization record) is a DNS security record that specifies which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for a domain, helping prevent unauthorized certificate issuance.

What is a CAA Record?

A CAA record, short for Certification Authority Authorization record, is a DNS record type that gives domain owners control over which certificate authorities are allowed to issue SSL/TLS certificates for their domain. Introduced by RFC 6844 and made mandatory for CAs by the CA/Browser Forum in 2017, CAA records are an important security layer in the web's certificate ecosystem.

Before issuing a certificate, all major CAs are required to check for CAA records on the domain. If a CAA record exists and does not list that CA as an authorized issuer, the CA must refuse to issue the certificate. This prevents malicious or negligent CAs from issuing certificates for domains they should not, which could be used for man-in-the-middle attacks.

A CAA record has three fields: a flag (usually 0 or 128), a tag (issue, issuewild, or iodef), and a value. The "issue" tag permits a CA to issue standard certificates. The "issuewild" tag controls wildcard certificates specifically. The "iodef" tag specifies a URL or email address where CAs should report policy violations.

How Does a CAA Record Work?

When a certificate authority receives a request to issue a certificate for a domain, it performs a CAA DNS lookup as part of its validation process. The CA queries for CAA records at the exact domain name, and if none are found, it walks up the domain tree (from subdomain to parent domain) until it finds CAA records or reaches the root.

If no CAA records exist anywhere in the hierarchy, any CA may issue a certificate — the default open state. If CAA records are present, only the CAs explicitly listed with an "issue" tag are permitted to issue certificates. The critical flag (128) tells CAs that if they do not understand the tag being used, they must refuse to issue the certificate, providing forward compatibility with future CAA extensions.

For example, a CAA record with the value "0 issue letsencrypt.org" permits only Let's Encrypt to issue certificates for that domain. Adding "0 issue comodoca.com" alongside it would also allow Comodo. To permit no CA to issue any certificate at all, you can publish "0 issue ;" (a semicolon as the value), which is useful for domains that should never have publicly trusted TLS certificates.

How to Check a CAA Record

To check the CAA records for any domain, use the CAA Record Checker at nslookup.net/tools/caa-record-checker. The tool retrieves all CAA records for the domain and displays the authorized certificate authorities, wildcard certificate permissions, and any violation reporting addresses. This is useful when troubleshooting certificate issuance failures, auditing your domain's security posture, or verifying that CAA records are correctly configured before switching certificate authorities.

Related Tool

CAA Record Checker

Try the Tool →

Frequently Asked Questions

What happens if I have a CAA record that does not include my current CA?

If your CAA record does not list your current certificate authority, that CA will refuse to renew or issue new certificates for your domain. This commonly causes unexpected certificate renewal failures with automated systems like Let's Encrypt. You must either add the CA to your CAA record or remove the restricting record before the certificate can be issued.

Do CAA records affect existing certificates?

No. CAA records only apply at the time of certificate issuance or renewal. If you have a valid, unexpired certificate, adding or changing CAA records will not revoke or invalidate it. The records will only affect future issuance attempts.

What is the difference between the "issue" and "issuewild" tags?

The "issue" tag controls which CAs can issue standard (non-wildcard) certificates for the domain. The "issuewild" tag specifically controls wildcard certificate issuance (certificates covering *.example.com). If you have an "issue" tag but no "issuewild" tag, the "issue" tag also governs wildcard certificates. If you want different rules for wildcards, add a separate "issuewild" record.

Are CAA records required for every domain?

CAA records are not required by the DNS specification — if none exist, any CA can issue certificates for the domain. However, publishing CAA records is considered a security best practice because they significantly reduce the risk of unauthorized certificate issuance. Organizations with strict security requirements or those in regulated industries should always publish CAA records.