All questions
Q & A DNS Records · September 11, 2026

What happens if I don't publish a CAA record?

No restriction — any trusted CA can issue certs for your domain. That’s not necessarily bad (it’s the historical default) but it does mean an attacker who compromises your registrar account, DNS host, or exploits a validation flaw could get a rogue cert issued from any CA. CAA closes that vector by restricting issuance to CAs you’ve listed.

Read the full guide
What Is a CAA Record? Certificate Authority Authorization Explained
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.
Related questions
Can I still get new SSL certificates if I publish CAA? How do I add a CAA record in Cloudflare? How does CAA tree climbing work? What is the iodef tag for? Which CAs check CAA records?