Guides CAA
What is CAA?
To serve a website securely (over `https://`) you need a TLS certificate, issued by a Certificate Authority (CA) such as Let's Encrypt or DigiCert. The catch: in principle any CA can issue a certificate for any domain. A CAA record limits that: in your DNS you declare which CAs may do it for your domain. If another CA gets a request, it's supposed to refuse.
How it works
Before a CA issues a certificate, it's required to check your CAA record. If the CA isn't on the list, it may not issue. This prevents someone from quietly getting a valid certificate for your domain through a different authority (for instance for a phishing site).
The check happens only at issuance. It says nothing about certificates that already exist.
The CA searches upward from the requested name to your main domain. One CAA record on example.com therefore also covers all your subdomains, unless a subdomain has its own CAA record.
What does the record look like?
A CAA record has three parts: a flag (usually 0), a tag, and a value.
issue: which CA may issue normal certificates, e.g.example.com CAA 0 issue "letsencrypt.org"issuewild: the same but specifically for wildcard certificates (*.example.com)iodef: an address where a CA can send a report if someone tries to request a disallowed certificate (though far from every CA does this)
Want to block all issuance? Set 0 issue ";". That says: no CA at all may issue.
Why you'd want this
CAA isn't mandatory and your website works fine without it. It does lower the chance that an attacker, or a misconfigured service, obtains a valid certificate for your domain. That matters, because with such a certificate someone can put up a fake copy of your site that shows a normal padlock in the browser. For public domains using TLS it's good hygiene, and some security standards ask for it.
Common mistakes
- Forgetting your own CA in the list, so your next certificate renewal fails
- Forgetting services that request certificates for you (CDN, hosting company, mail provider)
- Thinking CAA revokes existing certificates: it doesn't. It only works at new issuance
- A typo in the CA name (use the official one, e.g.
letsencrypt.org,digicert.com,sectigo.com,pki.goog)
Setting it up
- Make a list of all CAs that issue certificates for you (check your current certificates or ask your host)
- Add an
issuerecord per CA, and anissuewildif you use wildcards - Optionally add an
iodefaddress to receive reports - Publish and verify with the DNS Radar scan
Frequently asked questions
Do I really need CAA?
Not mandatory, but recommended for public domains using TLS. It's little effort and a useful extra barrier against abuse.
Does CAA block existing certificates?
No. CAA is only checked when a CA issues a new certificate. Existing certificates remain valid.
What if I use multiple CAs?
Just add multiple issue records, one per allowed CA. Don't forget the CA of automated services (like a CDN or your host).
What's the difference between issue and issuewild?
issue covers normal certificates. issuewild specifically covers wildcard certificates (*.example.com). Without an issuewild, wildcard issuance falls back to your issue rules.