CAA Record Generator

A CAA (Certification Authority Authorization) record is a DNS record that specifies which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for your domain. Before issuing a certificate, CAs are required to check CAA records and refuse issuance if they are not listed. CAA records reduce the risk of misissued certificates and limit your exposure if a CA is compromised — only the CAs you authorise can issue certificates for your domain.

The issue tag controls which CAs can issue standard (non-wildcard) certificates for the domain. The issuewild tag specifically controls issuance of wildcard certificates (*.example.com). If you have an issue record but no issuewild record, wildcard certificate issuance follows the issue rule. If you have an issuewild record, it overrides issue for wildcard certificates. To permit a CA for all certificates, add both issue and issuewild entries for that CA.

A CAA record with value 0 issue ";" (an issue record with an empty value) prohibits all CAs from issuing certificates for the domain. This can be useful for domains that should never have publicly trusted certificates, but will cause certificate renewal to fail for all providers including your current one. Only publish an empty CAA record if you are certain no certificates should be issued for that domain.

The iodef (Incident Object Description Exchange Format) tag specifies a URL or mailto address where CAs should report certificate issuance requests that violate your CAA policy. For example: 0 iodef "mailto:ssl-reports@example.com". This provides an early warning if someone attempts to obtain a certificate from an unauthorised CA. Not all CAs send iodef notifications, but major ones like Let's Encrypt and DigiCert support it.