CAA

CAA Record

Active

The CAA (Certification Authority Authorization) record specifies which Certificate Authorities are permitted to issue SSL/TLS certificates for a domain.

name TTL IN CAA flags tag "value"

In one line

The CAA (Certification Authority Authorization) record specifies which Certificate Authorities are permitted to issue SSL/TLS certificates for a domain. It prevents unauthorized certificate issuance – a security measure against certificate mis-issuance. CAs must check CAA records before issuing certificates.

Description

CAA records protect domains from unauthorized TLS certificate issuance. Certificate Authorities are required by the CA/Browser Forum to check CAA records before issuing certificates. If a CAA record exists and the CA is not listed, they must refuse issuance. An absent CAA record allows any CA to issue.

Examples

Allow only Let's Encrypt

shell

example.com.    3600    IN    CAA    0 issue "letsencrypt.org"

Allow with wildcard restriction

shell

example.com.    3600    IN    CAA    0 issue "sectigo.com"
example.com.    3600    IN    CAA    0 issuewild ";"

Check CAA records

shell

dig example.com CAA

Related Record Types

TXT

Specification

RFC 8659 – DNS CAA record specification →