What Is a CAA Record? Controlling SSL Certificate Issuance

What Is a CAA Record?

A CAA record (Certification Authority Authorization record) specifies which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for your domain. It’s a security control that helps prevent unauthorized certificate issuance.

The Basics

• CAA stands for “Certification Authority Authorization”
• Tells CAs whether they’re allowed to issue certificates
• CAs are required to check CAA records before issuing
• If no CAA record exists, any CA can issue
• Helps prevent certificate misissuance

Why CAA Records Matter

Without CAA records, any Certificate Authority could issue a certificate for your domain. CAA records:

• Limit certificate issuance to approved CAs only
• Reduce risk of unauthorized certificates
• Provide notification when issuance is attempted
• Required checking by CAs since September 2017

How CAA Records Work

The Certificate Issuance Process

1. You request a certificate from a CA
2. CA checks CAA records for your domain
3. If CA is authorized — Certificate issued
4. If CA is not authorized — Request denied
5. If no CAA record — Any CA can issue

CAA Record Structure

example.com.    3600    IN    CAA    0 issue "letsencrypt.org"

Component	Value	Description
Name	example.com	Domain name
Flags	0	Control flags
Tag	issue	Type of authorization
Value	letsencrypt.org	Authorized CA identifier

Flag Values

Flag	Meaning
0	Non-critical — CA may proceed if tag is unknown
128	Critical — CA must not issue if tag is unknown

In practice, flags are almost always 0.

CAA Record Types

issue

Authorizes a CA to issue standard certificates:

; Allow Let's Encrypt to issue certificates
example.com.    CAA    0 issue "letsencrypt.org"

; Allow DigiCert to issue certificates
example.com.    CAA    0 issue "digicert.com"

issuewild

Authorizes a CA to issue wildcard certificates specifically:

; Allow only DigiCert to issue wildcard certificates
example.com.    CAA    0 issuewild "digicert.com"

If no issuewild record exists, issue records apply to wildcards too.

iodef

Specifies where to send violation reports:

; Send reports via email
example.com.    CAA    0 iodef "mailto:security@example.com"

; Send reports via HTTPS
example.com.    CAA    0 iodef "https://example.com/caa-report"

Denying All Issuance

Use an empty issue tag to prevent any CA from issuing:

; No CA is authorized
example.com.    CAA    0 issue ";"

Common Configurations

Single CA (Let’s Encrypt)

example.com.    CAA    0 issue "letsencrypt.org"
example.com.    CAA    0 iodef "mailto:ssl-alerts@example.com"

Single CA with Wildcard Restriction

; Standard certs from Let's Encrypt
example.com.    CAA    0 issue "letsencrypt.org"

; No wildcard certs allowed
example.com.    CAA    0 issuewild ";"

example.com.    CAA    0 iodef "mailto:ssl-alerts@example.com"

Multiple CAs

; Allow multiple CAs
example.com.    CAA    0 issue "letsencrypt.org"
example.com.    CAA    0 issue "digicert.com"
example.com.    CAA    0 issue "sectigo.com"

example.com.    CAA    0 iodef "mailto:ssl-alerts@example.com"

Different CAs for Wildcards

; Let's Encrypt for standard certs
example.com.    CAA    0 issue "letsencrypt.org"

; DigiCert only for wildcard certs
example.com.    CAA    0 issuewild "digicert.com"

example.com.    CAA    0 iodef "mailto:ssl-alerts@example.com"

Common CA Identifiers

CA	Identifier
Let’s Encrypt	letsencrypt.org
DigiCert	digicert.com
Sectigo (Comodo)	sectigo.com
GoDaddy	godaddy.com
GlobalSign	globalsign.com
Amazon	amazon.com
Google Trust Services	pki.goog
Cloudflare	comodoca.com (via Sectigo)

Cloudflare Configuration

If using Cloudflare’s SSL:

; Cloudflare uses DigiCert and Let's Encrypt
example.com.    CAA    0 issue "digicert.com"
example.com.    CAA    0 issue "letsencrypt.org"
example.com.    CAA    0 issuewild "digicert.com"
example.com.    CAA    0 issuewild "letsencrypt.org"

AWS Certificate Manager

example.com.    CAA    0 issue "amazon.com"
example.com.    CAA    0 issuewild "amazon.com"

Best Practices for MSPs

1. Always Set CAA Records

Even if allowing any CA, explicit records are better than none:

• Documents your certificate policy
• Enables iodef reporting
• Provides audit trail

2. Start Permissive, Then Restrict

If unsure which CAs are in use:

1. Audit current certificates — Check all domains for existing certs
2. Add all current CAs — Don’t break renewals
3. Add iodef — Get notified of issuance attempts
4. Gradually restrict — Remove unused CAs over time

3. Include iodef Records

Always configure violation reporting:

example.com.    CAA    0 iodef "mailto:security@example.com"

4. Test Before Implementing

Verify CAA records don’t break certificate issuance:

# Check current CAA records
dig CAA example.com

# Test with SSLMate's CAA tester
# https://sslmate.com/caa/

5. Consider Subdomain Inheritance

CAA records are inherited by subdomains unless overridden:

; Applies to example.com and all subdomains
example.com.        CAA    0 issue "letsencrypt.org"

; Override for specific subdomain
app.example.com.    CAA    0 issue "digicert.com"

6. Document Certificate Sources

Track for each domain:

• Which CA issues certificates
• Certificate type (standard, wildcard, EV)
• Renewal process (manual, automatic)
• CAA record configuration

7. Coordinate with Certificate Automation

If using automated certificate issuance (Let’s Encrypt, cert-manager):

• Ensure CAA allows your automation CA
• Test renewal process after adding CAA
• Monitor for issuance failures

Frequently Asked Questions

What happens if I don’t have CAA records?

If no CAA records exist, any CA can issue certificates for your domain. Adding CAA records restricts issuance to only authorized CAs.

Will CAA records break my existing certificates?

No. CAA is only checked at issuance time. Existing certificates remain valid regardless of CAA changes. However, renewals will be affected.

Do CAA records affect subdomains?

Yes. CAA records are inherited by subdomains. If example.com has CAA records, app.example.com inherits them unless it has its own CAA records.

How do I know which CA to authorize?

Check your current certificates:

• View certificate details in browser
• Use openssl s_client -connect example.com:443
• Check your certificate management platform

Can CAA prevent certificate attacks?

CAA reduces risk by limiting which CAs can issue certificates. However, it relies on CAs checking and respecting CAA records. It’s one layer in defense-in-depth.

Do all CAs check CAA records?

Since September 2017, all publicly trusted CAs are required to check CAA records before issuing certificates. It’s part of the CA/Browser Forum Baseline Requirements.

---

Get Started with Unified DNS

CAA records are an important security control that’s often overlooked. Unified DNS lets you view, modify, audit, and backup CAA and all DNS records across your client domains — with automated backups and Hudu syncing to document your security configurations.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.