A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are allowed to issue TLS/SSL certificates for your domain. Every public CA has had to check it before issuing since September 2017.
So if your record only lists Let's Encrypt and someone asks a different CA for a certificate on your domain, that CA should turn them down, even if they've somehow passed its domain validation.
It's quick to set up and worth having. It won't help if someone gets into your DNS account though, because they can just edit the record.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
That allows Let's Encrypt, and nobody else, to issue certificates for example.com and its subdomains.
Most DNS control panels ask for the parts separately: flag 0, tag issue, value letsencrypt.org. For the root of the domain the name is usually @ or left blank.
CAA 0 issue "letsencrypt.org"
The record type, in the same way A, MX or TXT are record types.
CAA 0 issue "letsencrypt.org"
The flags. Only one flag is defined: 128, known as "issuer critical". With it set, a CA that doesn't understand the tag must refuse to issue. Every CA understands issue, issuewild and iodef, so 128 on those changes nothing. Use 0 unless you're relying on a newer tag and want CAs that don't know it to say no.
CAA 0 issue "letsencrypt.org"
The tag, which says what the record is for. The ones you'll actually use are issue, issuewild and iodef, all covered below.
CAA 0 issue "letsencrypt.org"
The value. For issue and issuewild it's the CA's identifier, which isn't always the same as its website. Google's is pki.goog, for example. There's a list further down.
issue covers normal certificates. issuewild covers wildcard certificates such as *.example.com.
If you don't have any issuewild records, wildcards follow your issue records. Once you add a single issuewild record, wildcards only follow issuewild.
A value of ";" means no CA at all. To allow Let's Encrypt but block wildcards completely:
CAA 0 issue "letsencrypt.org" CAA 0 issuewild ";"
And for a domain you own but never put a website on, this blocks every certificate:
CAA 0 issue ";"
Add a separate record for each CA. Any CA in the list can issue.
CAA 0 issue "letsencrypt.org" CAA 0 issue "pki.goog" CAA 0 issuewild "letsencrypt.org" CAA 0 iodef "mailto:security@example.com"
Here Let's Encrypt and Google can issue normal certificates, but only Let's Encrypt can issue wildcards. It's quite common to need more than one CA. Your CDN or hosting provider may get its certificates from somewhere different to you, and a second CA gives you a fallback if your usual one has problems.
CAA 0 iodef "mailto:security@example.com"
This asks a CA to tell you when it turns down a request because of your CAA records. An https:// URL is allowed as well as an email address. Very few CAs actually send these reports, so it's a nice extra, not something to depend on.
The CA looks for CAA records on the exact name in the certificate first. If there aren't any, it tries the parent, then the parent's parent, and stops at the first name that has some. A record on example.com therefore covers www.example.com, shop.example.com and everything else under it.
Records on a subdomain replace the parent's rather than adding to them. If example.com allows Let's Encrypt and you give shop.example.com its own record for DigiCert, Let's Encrypt can no longer issue for shop.example.com.
If the name is a CNAME, the lookup follows it, and any CAA records on the target are the ones that count. This catches people out when a subdomain points at a CDN or a SaaS platform.
| CA | Value |
|---|---|
| Let's Encrypt | letsencrypt.org |
| Google Trust Services | pki.goog |
| Amazon (ACM) | amazon.com (amazontrust.com, awstrust.com and amazonaws.com also work) |
| DigiCert | digicert.com |
| Sectigo, including ZeroSSL | sectigo.com |
| GlobalSign | globalsign.com |
| SSL.com | ssl.com |
There are more, with notes on each, in the full list of CA values. CAs do change these from time to time, so if a request gets refused it's worth checking the CA's own documentation. Cloudflare users usually don't need to list the CAs Cloudflare uses for its own certificates, as it adds those records itself once you create any CAA record. There's more on that in the Cloudflare guide.
Some CAs let you add parameters after the identifier. accounturi limits issuing to one ACME account, and validationmethods limits how the domain can be validated:
CAA 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/123456" CAA 0 issue "letsencrypt.org; validationmethods=dns-01"
Let's Encrypt supports both. Support elsewhere is patchy, so check with your CA before relying on them.
You can use the form below, or from a terminal:
dig CAA example.com +short
There's more on checking CAA records from the command line, including Windows, and why the result can differ from what a CA sees.
CAs can reuse a CAA lookup for up to 8 hours, and your DNS TTL adds to that. If you've just fixed a record and requests are still being refused, give it a while before changing anything else.
No. Without one, any CA is allowed to issue for your domain. Adding one closes that off and only takes a few minutes.
New certificates and renewals get refused, and that's usually how people notice. Existing certificates keep working until they expire. If renewals break straight after moving host or CDN, check that the new provider's CA is in your records. There's more on this in fixing "CAA record prevents issuance".
issue and issuewild are only for TLS certificates. S/MIME email certificates have their own tag, issuemail.