All questions
Q & A DNS Records · September 11, 2026

Which CAs check CAA records?

Every CA that participates in the CA/Browser Forum — which is every CA whose certs are trusted by mainstream browsers. Let’s Encrypt, DigiCert, Sectigo, GlobalSign, Entrust, GoDaddy, Amazon, Google Trust Services all check CAA. This has been mandatory since 2017. A CA that ignores CAA loses its browser trust.

Read the full guide
What Is a CAA Record? Certificate Authority Authorization Explained
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.
Related questions
Can I still get new SSL certificates if I publish CAA? How do I add a CAA record in Cloudflare? How does CAA tree climbing work? What happens if I don't publish a CAA record? What is the iodef tag for?