Glossary
DNS RECORDS

CAA

Certification Authority Authorization — a DNS record listing which certificate authorities are allowed to issue TLS certs for a domain. Blocks rogue or mistaken issuance.

CAA (Certification Authority Authorization) is a DNS record type defined in RFC 8659 that tells the world which certificate authorities may issue TLS certificates for your domain. If a CA’s own logic honours CAA (all reputable CAs must, as of the CA/Browser Forum baseline), a certificate request from any other CA is refused before it can even reach validation.

Record Format

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "digicert.com"
example.com.  CAA  0 iodef "mailto:[email protected]"

Tags

  • issue — a CA allowed to issue any cert (DV, OV, EV) for the domain
  • issuewild — a CA allowed to issue wildcard certs (*.example.com)
  • iodef — where the CA reports violated CAA attempts (mailto: or https:)

Tree Climbing

CAA validation walks up the DNS tree. A request for api.acme.example.com checks CAA on api.acme.example.com, then acme.example.com, then example.com. The first record set found is authoritative.

Common Miss

Publishing CAA without an iodef address means you never learn when someone tried to get a rogue cert issued. Always add an iodef contact.

Read what an SSL certificate is, check the SSL/TLS glossary entry, and browse every major DNS record type.

← All terms Learning hub →