TechCompare LogoTechCompare
Showing centimeters. Press to switch to inches.Showing inches. Press to switch to centimeters.

What is a CAA record? Choosing who may issue your TLS certificates

By TechCompare · Updated · How we check

No CAA record means any public CA may issue for your domain. Add an issue tag for each CA you use, and every other CA has to refuse.

A CAA record lists the certificate authorities (CAs) allowed to issue TLS certificates for a domain. Before a public CA issues one, it has to look up the domain's CAA records and stop if it isn't on the list. With no CAA record at all, any public CA may issue. A single record like 0 issue "letsencrypt.org" limits the domain to Let's Encrypt.

Topic
CAA records
Certificate control
Category
Record types
What each record does
Look up a domain's CAA records. Check records on Cloudflare or compare several resolvers, with SPF, DMARC and DKIM explained.
Edit in the full tool

How this is calculated

Each CAA record has three parts: a flag, a tag and a value. The issue tag allows a CA to issue normal certificates, issuewild covers wildcard certificates like *.example.com, and iodef gives an email or web address where a CA can report a request it turned down. The flag is almost always 0. A flag of 128 marks the tag as critical, so a CA that doesn't understand the tag must not issue.

CAs find the records by climbing the name. For shop.example.com, a CA checks shop.example.com first, and if there are no CAA records there it checks example.com. So one set on the root domain covers every subdomain that doesn't have its own.

The rules come from RFC 8659, and the CA/Browser Forum has required every public CA to check CAA since September 2017. Browsers don't check it, and it can't stop a CA that breaks the rules. It guards against mistakes and tricks at a CA you never meant to use.

The DNS Lookup shows CAA records in their readable form, like 0 issue "letsencrypt.org", even when a resolver sends them as raw bytes.

Verdict

Add a CAA record for each CA that issues certificates for you, including the ones your CDN or host uses behind the scenes, or renewals will start to fail. Add issuewild only when wildcard rules differ, and an iodef address if you want reports. Then look up the root domain and any subdomain with a CAA set of its own.

More DNS scenarios

TXT records
The free text record that holds verification codes, SPF, DKIM keys and DMARC policies.
View details
SPF vs DKIM vs DMARC
SPF checks the sending server, DKIM checks the message, and DMARC ties both to the From address.
View details
MX records
How senders find your mail servers, what the priority number does, and the null MX for domains that take no mail.
View details

Related guides

RS256 vs ES256
RSA vs ECDSA keys, the same choice a TLS certificate makes.
View guide
JWKS and kid explained
Another way a service publishes which keys to trust.
View guide

Frequently asked questions

What happens if my domain has no CAA record?
Any public CA may issue a certificate for it, which is how most domains work. CAA is optional. It only narrows the list once you add it.
Do I need a CAA record for each subdomain?
No. A CA climbs from the name it's issuing for up toward the root and uses the first CAA records it finds. Records on example.com cover www.example.com and every other subdomain without a CAA set of its own.
What value do I use for Let's Encrypt?
letsencrypt.org, as in 0 issue "letsencrypt.org". Every CA lists the value it checks for in its own documentation, so look it up for each CA you add.

Related tools

Subnet Calculator

Calculate network address, broadcast address, and usable IP ranges for IPv4/IPv6.

Use tool

Text Encoding Converter

Convert text to Base64, binary, hex, URL encoding and HTML entities, and back again.

Use tool

JWT Decoder & Validator

Decode JWT headers and claims, check exp, nbf and iat, and verify signatures locally with your own key.

Use tool