What Is a CAA Record?
A CAA (Certification Authority Authorization) record is a DNS record that names which certificate authorities are permitted to issue TLS certificates for your domain. Every publicly trusted CA is required, as of 2017 CA/Browser Forum rules, to check for a CAA record before issuing — if one is published and doesn't list them, they must refuse.
Last updated August 9, 2026.
A basic CAA record
example.com. CAA 0 issue "letsencrypt.org" example.com. CAA 0 issuewild "letsencrypt.org" example.com. CAA 0 iodef "mailto:[email protected]"
issue authorizes the named CA to issue standard certificates. issuewild covers wildcard certificates specifically — omit it and wildcard issuance is denied to everyone. iodef tells a CA where to send a report if it receives (and refuses) a request from someone else.
Why this matters even with no active threat
With no CAA record, any of the hundreds of publicly trusted certificate authorities may issue a certificate for your domain — normally that requires proving control of the domain first, so CAA isn't a defense against a single compromised CA account so much as a constraint on which CA a mistaken or compromised issuance could come from, and a paper trail (via iodef) if someone tries anyway.
Publishing one
Add the CAA record type at your DNS host (most major DNS providers support it as a standard record type alongside A, TXT, and MX) naming the CA you actually use — for example letsencrypt.org, digicert.com, or sectigo.com — and, optionally, an iodef address to be told about refused requests.