CAA Records. Control Who Issues Your Certificates

What is a CAA record?

There are dozens of publicly trusted certificate authorities, and by default any of them can issue a certificate for your domain to anyone who passes domain validation. Validation usually means proving control of a DNS record or an HTTP path, which is exactly what an attacker has after hijacking your DNS, your registrar account, or a subdomain pointing at an abandoned cloud resource.

A CAA record (RFC 8659) shrinks that attack surface to the CAs you actually use. Since 2017, checking CAA before issuance is mandatory for every CA in the browser trust programs, this isn't a hint, it's an enforced rule of the ecosystem. If your record names only letsencrypt.org, a validation request at any other CA must be refused automatically.

Why it matters

• It blocks rogue issuance: a fraudulent cert for your domain enables convincing phishing sites and man-in-the-middle interception of your traffic, and of your inbound mail if MX hosts are covered.
• It limits blast radius: if a subdomain takeover or DNS slip happens, the attacker can only attempt issuance at CAs you've already approved, which are the ones whose issuance logs you're presumably watching.
• It's nearly free: one or two DNS records, no certificates to buy, no software to run, and no effect on normal operation when configured to match your real CA.

How to check it

dig +short example.com CAA
# Expect something like:
# 0 issue "letsencrypt.org"
# 0 iodef "mailto:security@example.com"

Empty output means no CAA record, any CA may issue. Also check that what's listed matches the CA that actually issues your current certs (look at your cert's issuer in the browser, or use our SSL checker).

Anatomy of a CAA record

Each record is flags tag "value":

• issue, which CA may issue regular certificates. The value is the CA's identifying domain: letsencrypt.org, digicert.com, sectigo.com, pki.goog (Google Trust Services), amazon.com (AWS ACM).
• issuewild, separately controls wildcard certificates. If absent, issue rules apply to wildcards too.
• iodef, where CAs should report violation attempts: a mailto: address or HTTPS endpoint.
• The flags byte is almost always 0. 128 marks the record critical.
• 0 issue ";", the special "nobody may issue" value, useful for parked domains that should never have certs.

Setting it up, step by step

1. Inventory your certificate sources. Web server certs, CDN-managed certs (Cloudflare provisions through Google Trust Services, Let's Encrypt, and others), load balancer certs (AWS ACM), mail server certs. Each may use a different CA.
2. Publish an issue record for each CA in use, plus an iodef:

   example.com.  CAA  0 issue "letsencrypt.org"
   example.com.  CAA  0 issue "pki.goog"
   example.com.  CAA  0 iodef "mailto:security@example.com"

3. Wait one full certificate renewal cycle before trusting the config. A successful renewal proves your allowlist matches reality.
4. Optionally add issuewild ";" if you never use wildcard certs, removing a whole class of over-broad issuance.

Common mistakes

1. Forgetting a CA you actually use. The classic: allowing only digicert.com while your load balancer renews through ACM. Everything works until the renewal window.
2. Switching CAs without updating CAA first. Update DNS, wait for TTL, then request from the new CA.
3. Assuming CAA revokes existing certs. It only governs future issuance. Certs issued before you published the record remain valid until expiry.
4. No iodef. You're turning down free intelligence about attempted mis-issuance against your domain.
5. Publishing CAA on a spoofable zone. Without DNSSEC, an attacker who can forge your DNS answers can hide your CAA record from the validating CA. CAA + DNSSEC together close the loop.

Monitoring CAA going forward

CAA failures are time bombs rather than explosions: the record drifts out of sync with your actual CA usage today, and the impact lands at the next renewal, weeks or months later, as a confusing "issuance refused" error or a silently expired cert.

DomainsDoc checks your CAA records on every scan and alerts you when they change unexpectedly or conflict with the CA observed issuing your live certificate, alongside SSL expiry, DNSSEC, and the rest of your domain's health, so renewal-time surprises get caught while they're still cheap. Add your domain to start, plans on the pricing page.