CAA Records

What Is a CAA Record?

A CAA record is a DNS record that lists the certificate authorities allowed to issue certificates for your domain. Every publicly trusted CA checks it before issuing and refuses when a record exists that doesn't list it. With no CAA record, any CA in the browsers' trust stores can issue for you.

Anatomy of a CAA Record

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Part	Meaning
0	Flags. Use 0. 128 marks the tag critical: a CA that doesn't understand the tag must refuse to issue.
issue	The tag
"letsencrypt.org"	The value, here the CA's identifier

CAA Record Tags

Tag	What it controls
issue	Which CAs may issue certificates for the name. It covers wildcards too, unless an issuewild record is present.
issuewild	Which CAs may issue wildcard (*.) certificates. When present, it takes over from issue for wildcards.
issuemail	Which CAs may issue S/MIME certificates for email addresses at the domain (RFC 9495). It has no effect on TLS certificates.
issuevmc	Which CAs may issue Verified Mark Certificates, the certificates behind BIMI logos. It has no effect on TLS certificates.
iodef	Where a CA can report a request that broke your policy, as a mailto: or https: URL. Reporting is best effort, so don't rely on it for alerting.

An issue value can also carry parameters. Let's Encrypt honors accounturi, which limits issuance to your own ACME account, and validationmethods, which limits how domain control is proved.

CAA Values for Common CAs

The value has to match an identifier the CA publishes. These come from the CCADB, the database of CA information the browsers share. Where a CA recognizes several values, any one of them works.

CA	Value
Let's Encrypt	letsencrypt.org
DigiCert	digicert.com
Sectigo	sectigo.com
GlobalSign	globalsign.com
Google Trust Services	pki.goog
Amazon Trust Services (AWS Certificate Manager)	amazon.com
GoDaddy	godaddy.com
SSL.com	ssl.com

Examples

One CA for everything:

example.com.  IN  CAA  0 issue "letsencrypt.org"

Two CAs, wildcards from only one of them, and violation reports by email:

example.com.  IN  CAA  0 issue "pki.goog"
                    example.com.  IN  CAA  0 issue "sectigo.com"
                    example.com.  IN  CAA  0 issuewild "sectigo.com"
                    example.com.  IN  CAA  0 iodef "mailto:security@example.com"

Issuance locked to one Let's Encrypt account:

example.com.  IN  CAA  0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890"

No CA at all, for a name that should never carry a public certificate:

internal.example.com.  IN  CAA  0 issue ";"

A record at the apex covers every subdomain without one of its own. A subdomain overrides it by publishing its own record. How a CA walks the DNS tree covers the lookup order in detail.

How to Check Your CAA Record

$ dig CAA example.com +short
                    0 issue "letsencrypt.org"
                    0 iodef "mailto:security@example.com"

Empty output means there's no record at that exact name, so check the parent domains too: a CA keeps climbing toward the apex until it finds one. The mrdns.com DNS lookup queries CAA if you'd rather not use dig.

To write a record for the CA you already use, the CAA Generator in the Generator Labs portal reads the certificate chain your server sends, identifies the CA, and builds the record for your DNS provider or zone file.

What Happens When It's Wrong

Problem	Result
No CAA record on the name or any parent	Any CA may issue for the domain
Your CA isn't listed	Your current certificate keeps working, but its renewal is refused
issue ";"	No CA can issue or renew
The lookup fails (SERVFAIL or a timeout)	The CA can't read your policy and will usually refuse; Let's Encrypt does
Flag 128 on a tag the CA doesn't recognize	The CA must refuse
A malformed value, such as a trailing dot on the CA's domain	The record doesn't name your CA in a form it recognizes, so it refuses

Most of these surface at renewal, when a certificate is days from expiring and automation that has worked for years suddenly fails.

Monitor Your CAA Records

Generator Labs Certificate Monitoring checks the CAA record for every hostname you monitor, alongside the certificate itself. It flags a missing record, a record that doesn't allow the CA that issued your current certificate, one that forbids every CA, an unknown critical tag, a malformed value, and a lookup that fails. The CAA check runs even when the service itself can't be reached. You hear about the problem the day the record changes, weeks before a renewal would fail. Each finding is explained, with its fix, in the CAA findings reference.