What is CAA?

HTTPS certificates are issued by certificate authorities (CAs) such as Let’s Encrypt, DigiCert or Sectigo. A CAA record is a DNS record that names the authorities allowed to issue certificates for your domain. Publicly trusted CAs must check it before issuing, and refuse if they are not listed.

Why it matters

Without a CAA record, any CA may issue a certificate for your domain. If someone fools one of them, they get a certificate in your name. CAA narrows that risk to the few authorities you actually use. Having no CAA is not an error, but it is a cheap extra layer of protection.

How the record looks

Each CAA record has three parts: a flags number (usually 0), a tag and a value. The issue tag names a CA allowed to issue normal certificates, issuewild one allowed to issue wildcard certificates (such as *.example.com), and iodef an address where CAs can report requests they refused.

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "digicert.com"
example.com.  CAA  0 issuewild "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:security@example.com"

Create a correct record

1. List where the certificates for your domain and every subdomain come from: your host, your CDN (Cloudflare, for example), your email service and any other service that serves HTTPS on your domain.
2. Take each CA’s CAA identifier from its own documentation; for Let’s Encrypt it is letsencrypt.org. Some services, such as Cloudflare, use several CAs and publish their list.
3. In your domain’s DNS panel, create one record of type CAA per CA: name @, flags 0, tag issue, and the CA’s identifier.
4. If you use wildcard certificates, add an issuewild record for that CA too.
5. Optionally add an iodef record with your own email address.
6. Check the domain again on CheckNet’s DNS page.

Common problems

• Renewals start failing: the CA your host or CDN uses is not in the record. Add it with an issue record.
• A subdomain gets no certificate: the CAA on your main domain also applies to subdomains, unless a subdomain has CAA records of its own.
• You want no wildcard certificates at all: publish 0 issuewild ";".

Before adding CAA, note when your current certificates renew, and after the first automatic renewal make sure the new certificate was actually issued.

Check it with CheckNet

On CheckNet’s DNS page, “CAA names which authorities may issue certificates” means a record was found. “No CAA record” is a note, not an error: it means any CA may issue.