Back to Learning Hub
SECURITY September 11, 2026 · 9 min read · 8K/mo

What Is a CAA Record? Certificate Authority Authorization Explained

CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.

D
DomainScan Team
DomainScan
Share
SECURITY

A CAA record (Certification Authority Authorization, RFC 8659) is a DNS entry declaring which certificate authorities are allowed to issue TLS certificates for your domain. It’s a DNS-level whitelist that CAs check before issuing. Since 2017, every CA that participates in the CA/Browser Forum is required to honour CAA — which means every CA whose certs are trusted by browsers.

CAA is cheap. It costs nothing to deploy. It defends against a real historical class of attack — CA compromise, mis-issuance, and social-engineered cert requests.

The Record — Format

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "digicert.com"
example.com.  CAA  0 iodef "mailto:[email protected]"

Fields, left to right:

  • Flags (0) — critical flag; 0 = advisory, 128 = critical
  • Tag — one of issue, issuewild, iodef, contactemail, contactphone
  • Value — the CA’s identifier string (per each CA’s own docs), or a mailto: / https: URL for iodef

Tags

issue

Names a CA allowed to issue any cert (DV, OV, EV) for the domain.

example.com.  CAA  0 issue "letsencrypt.org"

Multiple issue records = multiple allowed CAs. Zero issue records = no CA may issue.

issuewild

Names a CA allowed to issue wildcard certs (*.example.com). Separate from issue because wildcard issuance carries extra risk. If not present, wildcard rules default to the issue policy.

example.com.  CAA  0 issuewild "letsencrypt.org"

iodef

Where CAs should report attempted violations. Mailto: or https: URL.

example.com.  CAA  0 iodef "mailto:[email protected]"
example.com.  CAA  0 iodef "https://example.com/csr-report"

Publishing CAA without an iodef contact means you never learn about rogue-issuance attempts.

Denying All Issuance

example.com.  CAA  0 issue ";"

The ; value blocks all issuance. Useful for parked domains or domains that should never have certs.

Tree Climbing

CAA validation walks up the DNS tree. A cert request for api.acme.example.com:

  1. Look up CAA at api.acme.example.com
  2. If none, look up at acme.example.com
  3. If none, look up at example.com
  4. First CAA record set found is authoritative

Publish CAA at your root and it applies to every subdomain automatically.

CA-Specific Identifier Strings

Each CA has an identifier you use in the issue value. Common ones:

CAIdentifier
Let’s Encryptletsencrypt.org
DigiCertdigicert.com
Sectigosectigo.com
Entrustentrust.net
GlobalSignglobalsign.com
GoDaddygodaddy.com
Amazon Trust Servicesamazon.com
Google Trust Servicespki.goog

Consult each CA’s docs for their exact string.

Common Deployments

Let’s Encrypt only

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:[email protected]"

Two CAs (mixed)

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "digicert.com"
example.com.  CAA  0 issuewild "digicert.com"
example.com.  CAA  0 iodef "mailto:[email protected]"

Deny all except iodef monitoring

example.com.  CAA  0 issue ";"
example.com.  CAA  0 iodef "mailto:[email protected]"

What CAA Doesn’t Do

  • Doesn’t revoke existing certs — only affects new issuance. Certs already issued remain valid until they expire or are revoked.
  • Doesn’t restrict cert usage — only who can issue them.
  • Doesn’t cover self-signed certs — CAs enforce CAA; a self-signed cert bypasses the check entirely (but isn’t browser-trusted anyway).
  • Doesn’t validate DNSSEC — the record must be served, but standard CAA doesn’t require the DNS to be signed. (Some CAs use validated CAA when available.)

Common Mistakes

  • Publishing CAA without an iodef contact — silent, no visibility
  • Forgetting to update CAA when switching CAs — new CA can’t issue, cert requests fail
  • Setting critical flag (128) on unrecognized tags — CAs must refuse issuance until they understand the tag
  • Publishing CAA at a subdomain without matching the parent — the subdomain’s CAA wins (tree climbing)

Deployment Steps

  1. Decide which CAs you want to allow — start with the ones you actively use
  2. Get your iodef contact ready — a monitored mailbox
  3. Publish CAA records at your root domain (they inherit to subdomains via tree climbing)
  4. Verify with DomainScan’s CAA record lookup
  5. Wait 24 hours before requesting new certs to allow propagation
  6. Re-verify by requesting a cert — should succeed if the CA is in your issue list

Tools

Check the CAA glossary entry, read what an SSL certificate is, and check the DNSSEC entry for stronger cryptographic anchoring.

Common Questions

01

Which CAs check CAA records?

Every CA that participates in the CA/Browser Forum — which is every CA whose certs are trusted by mainstream browsers. Let's Encrypt, DigiCert, Sectigo, GlobalSign, Entrust, GoDaddy, Amazon, Google Trust Services all check CAA. This has been mandatory since 2017. A CA that ignores CAA loses its browser trust.

02

What happens if I don't publish a CAA record?

No restriction — any trusted CA can issue certs for your domain. That's not necessarily bad (it's the historical default) but it does mean an attacker who compromises your registrar account, DNS host, or exploits a validation flaw could get a rogue cert issued from any CA. CAA closes that vector by restricting issuance to CAs you've listed.

03

Can I still get new SSL certificates if I publish CAA?

Yes — CAA only restricts which CAs can issue. If you list Let's Encrypt and DigiCert in CAA, both can issue for your domain. If you list only Let's Encrypt and later try to get a cert from Sectigo, Sectigo will refuse. Update CAA to include the new CA before requesting a cert from them.

04

What is the iodef tag for?

iodef (Incident Object Description Exchange Format) is a CAA tag naming a mailto: or https: endpoint that CAs should report attempted violations to. If someone tries to get a rogue cert from a CA not in your issue list, the CA emails your iodef contact. Publish CAA without iodef and you'll never learn about rogue-issuance attempts. Publish CAA with iodef and you get an early-warning signal.

05

How does CAA tree climbing work?

CAA validation walks up the DNS tree until it finds a record. A request for cert issuance on api.acme.example.com checks CAA on api.acme.example.com first; if none exists, checks acme.example.com; if none, checks example.com. The first CAA record found is authoritative. Publish CAA at your root domain and it applies to every subdomain automatically.

#security#dns-records#dns#domainscan
D
DomainScan Team
Writes about DNS infrastructure, email authentication, domain security, and the engineering behind automated domain intelligence.
Related Articles
DNS INTELLIGENCE
DNS INTELLIGENCE Sep 11, 2026 11 min
How DNS Propagation Actually Works (And Why 24 Hours Is a Lie)
DNS propagation isn't magical. It's a function of TTLs, resolver caches, and how you sequenced your DNS change. Understand the moving parts and you can plan changes with confidence — and know when '24 hours' is nonsense.
D
DomainScan Team
DNS FUNDAMENTALS
DNS FUNDAMENTALS Aug 20, 2026 10 min
DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and More
DNS records are the building blocks of how the internet resolves domain names to servers. Each record type has a specific job: routing web traffic, delivering email, proving domain ownership, or preventing spoofing.
D
DomainScan Team
SOA RECORD
SOA RECORD Aug 21, 2026 9 min
What Is an SOA Record? The DNS Zone's Control File Explained
The SOA record is DNS's control file — it governs zone transfers, cache TTLs, and negative response lifetimes. Every misconfiguration here ripples across every resolver on the internet.
D
DomainScan Team