What is a CAA record?
Reviewed by Prabath Thalangama · Last updated
A CAA record lists the certificate authorities allowed to issue TLS certificates for your domain. Public CAs must check it before issuing and refuse if they are not listed. This lookup shows each CAA record's flag, tag and value, so you can confirm your CA, such as Let's Encrypt, is permitted.
No CAA record means any public CA may issue for the domain. Adding one limits that to the CAs you use, which reduces the damage from a mis-issued certificate. CAs look for CAA on the exact name first, then on each parent up to the apex.
The issue tag covers normal certificates, issuewild covers wildcards, and iodef gives an address where CAs can report refused requests.
How do I check CAA records?
- Enter the domain or subdomain you request certificates for.
- Make sure every CA you use, including the one behind your CDN or hosting provider, appears in an issue or issuewild record.
How to read the results
- flag
- 0 normally. 128 marks the record critical: a CA that doesn't understand the tag must not issue.
- tag
- issue, issuewild or iodef.
- value
- The CA's domain, for example letsencrypt.org, digicert.com or pki.goog. An empty value (";") forbids issuance.
Common CAA problems
Certificate renewal fails with a CAA error
Your CA, or the CA your CDN uses, isn't in the CAA records. Add an issue record for it.
example.com. CAA 0 issue "letsencrypt.org"Wildcard certificate refused
An issuewild record exists but doesn't list your CA. Wildcard requests check issuewild before issue.
Examples and command-line equivalents
Look up CAA records
dig +short CAA example.comAllow Let's Encrypt and Google Trust Services
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "pki.goog"
example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"Frequently asked questions
Do I need a CAA record?
It isn't required, but it's a cheap safeguard: it stops CAs you don't use from issuing certificates for your domain.
Does a CAA record affect certificates that already exist?
No. CAs check it only at issuance and renewal. Existing certificates stay valid until they expire or are revoked.
Further reading
- Let's Encrypt with Certbot, Including Renewal That Doesn't Break
- RFC 8659: DNS Certification Authority Authorization (CAA)
- Run a full Super Scan to check DNS, email, website and TLS for a domain at once.