All questions
Q & A DNS Records · September 11, 2026

How does CAA tree climbing work?

CAA validation walks up the DNS tree until it finds a record. A request for cert issuance on api.acme.example.com checks CAA on api.acme.example.com first; if none exists, checks acme.example.com; if none, checks example.com. The first CAA record found is authoritative. Publish CAA at your root domain and it applies to every subdomain automatically.

Read the full guide
What Is a CAA Record? Certificate Authority Authorization Explained
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.
Related questions
Can I still get new SSL certificates if I publish CAA? How do I add a CAA record in Cloudflare? What happens if I don't publish a CAA record? What is the iodef tag for? Which CAs check CAA records?