What Is a CAA Record? Restricting Certificate Issuance

What CAA Records Do

Without a CAA record, any of the hundreds of trusted Certificate Authorities can issue a certificate for your domain. A CAA record narrows this to only the CAs you explicitly authorise. CAs are required to check CAA records before issuing a certificate — failure to do so violates CA/Browser Forum rules.

CAA Record Format

example.com    CAA    0 issue "letsencrypt.org"
example.com    CAA    0 issue "digicert.com"
example.com    CAA    0 issuewild "letsencrypt.org"
example.com    CAA    0 iodef "mailto:security@example.com"

Tags Explained

• issue: specifies which CA may issue single-name certificates
• issuewild: specifies which CA may issue wildcard certificates (separate from issue)
• iodef: where the CA should send reports if a prohibited issuance is requested

The flag value (0) is required by the format; 128 would indicate a critical tag that must not be ignored.

Common CAA Values by Provider

What Happens If a Prohibited CA Tries to Issue

The CA checks your CAA record, sees it is not listed, and refuses to issue the certificate. They may optionally report the attempt to your iodef address.

CAA Does Not Revoke Existing Certificates

CAA only prevents future issuance. Certificates already issued remain valid until expiry regardless of CAA changes.

Inspect CAA records with our DNS Lookup tool.