All questions
Q & A DNS Records · September 11, 2026

What is the iodef tag for?

iodef (Incident Object Description Exchange Format) is a CAA tag naming a mailto: or https: endpoint that CAs should report attempted violations to. If someone tries to get a rogue cert from a CA not in your issue list, the CA emails your iodef contact. Publish CAA without iodef and you’ll never learn about rogue-issuance attempts. Publish CAA with iodef and you get an early-warning signal.

Read the full guide
What Is a CAA Record? Certificate Authority Authorization Explained
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.
Related questions
Can I still get new SSL certificates if I publish CAA? How do I add a CAA record in Cloudflare? How does CAA tree climbing work? What happens if I don't publish a CAA record? Which CAs check CAA records?