What Is a CAA Record?
A CAA (Certification Authority Authorization) record is a DNS record that names which certificate authorities are permitted to issue TLS certificates for your domain. Every publicly trusted CA is required, as of 2017 CA/Browser Forum rules, to check for a CAA record before issuing — if one is published and doesn't list them, they must refuse.
Last updated August 9, 2026.
A basic CAA record
example.com. CAA 0 issue "letsencrypt.org" example.com. CAA 0 issuewild "letsencrypt.org" example.com. CAA 0 iodef "mailto:security@example.com"
issue authorizes the named CA to issue standard certificates. issuewild covers wildcard certificates specifically, and takes precedence over issue for wildcard requests — if you publish no issuewild at all, wildcard issuance falls back to whatever your issue records allow. Publishing issuewild ";" is how you deny wildcards to everyone. iodef tells a CA where to send a report if it receives (and refuses) a request from someone else.
Why this matters even with no active threat
With no CAA record, any of the hundreds of publicly trusted certificate authorities may issue a certificate for your domain — normally that requires proving control of the domain first, so CAA isn't a defense against a single compromised CA account so much as a constraint on which CA a mistaken or compromised issuance could come from, and a paper trail (via iodef) if someone tries anyway.
Publishing one
Add the CAA record type at your DNS host (most major DNS providers support it as a standard record type alongside A, TXT, and MX) naming the CA you actually use — for example letsencrypt.org, digicert.com, or sectigo.com — and, optionally, an iodef address to be told about refused requests.
List every CA that issues for the domain before you publish, including ones you don't manage directly: a CDN, load balancer, or hosting platform that provisions its own certificate uses its own CA, and a CAA record that omits it will block that renewal. Getting this wrong doesn't break the site immediately — the existing certificate keeps working — it breaks the next issuance, which is why it typically surfaces weeks later as a failed renewal.
Related
FAQ
Do I need a CAA record if I only use one certificate authority?
Yes — CAA doesn't assume good behavior from anyone, including a compromised or mistaken issuance by a CA you didn't authorize. Using only one CA today doesn't stop a different CA from issuing a certificate for your domain tomorrow if no CAA record exists to block it; the record is what turns 'we only use Let's Encrypt' from a habit into an enforced constraint.
What happens if I forget a CA my CDN or host uses?
The existing certificate keeps working, so nothing breaks immediately — it breaks the next renewal, which that CA will refuse because your CAA record doesn't list it. This typically surfaces weeks later as a failed renewal rather than an immediate outage, which is why it's easy to miss when first publishing a record.
Does CAA stop someone from stealing my domain's traffic?
No — CAA restricts which certificate authorities may issue a cert for your domain, it doesn't touch DNS control, hosting, or traffic routing. It narrows one specific attack path (an unauthorized CA issuing a look-alike certificate) and gives you an iodef notification if a non-authorized CA tries and gets refused.
Can I have multiple issue tags for different CAs?
Yes — publish one issue record per authorized CA, and a CA not listed in any of them must refuse to issue. This is normal for sites using more than one CA (for example, a primary host plus a CDN that provisions its own certificates) and doesn't need iodef or issuewild set to work.