Reference guide
What is a CAA record?
Without a CAA record, any certificate authority in the world can issue a certificate for your domain. A CAA record cuts that list down to the ones you name, and a single line is enough.
7 min readUpdated September 12, 2026
In short
A CAA record is a DNS record naming the certificate authorities allowed to issue a certificate for your domain. Every authority has to read it before issuing, and must refuse when its own identifier is not listed. With no CAA record published, every authority is allowed.
What CAA is for
A browser trusts several hundred certificate authorities. Any one of them can technically issue a valid certificate for any domain, yours included. One sloppy validation or one compromise is all it takes for a certificate browsers accept to exist without you ever hearing about it.
CAA narrows that surface to what you decide. Publish in DNS the names of the authorities you use, and the rest are bound to refuse. The check is mandatory for every authority browsers trust, which makes CAA one of the few DNS records backed by an industry rule rather than by goodwill.
The record costs one line and never needs renewing. For the effort involved, it is one of the best-value protections you can put on a domain — as long as you remember to update it the day you change hosts.
A CAA record, term by term
Three fields, always in this order. The syntax is short, which makes it easy to get wrong without noticing.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"0The flagOnly one bit is defined, the one worth 128, called critical. At zero, an authority that does not understand the property may carry on regardless. At 128, it must refuse to issue rather than ignore what it did not understand.
issueThe propertyWhat the line authorizes. Three main values: ordinary issuance, wildcard issuance, and the address to notify on refusal.
"letsencrypt.org"The valueThe authority's identifier, exactly as it publishes it in its own documentation. It is not necessarily its trading name, nor the domain its website sits on.
";"A lone semicolonAuthorizes nobody. On the issuewild line it blocks every wildcard certificate while leaving ordinary ones possible.
iodefThe reporting addressWhere to report a refused request. Acting on it is optional for the authority: not all of them do.
CAA properties and their values
A CAA line carries a property and a value. Four properties are standardized; two are enough in nearly every case.
| Property | What it authorizes | Possible values |
|---|---|---|
| issue | Issuance for the domain and, with no issuewild line present, for its wildcards too. | An authority identifier, or a lone semicolon to authorize nobody. |
| issuewild | Wildcard certificates only. When present, it overrides the issue property for that case. | The same: an identifier, or a lone semicolon. |
| iodef | Nothing. It states where to report a refused request. | A mailto: address or an https: address. |
| issuemail | Issuance of S/MIME mail certificates, a separate matter from website certificates. | An authority identifier, or a lone semicolon. |
| Flag 0 | An authority that does not understand the property may ignore it. | The usual value, and the one to set by default. |
| Flag 128 | An authority that does not understand the property must refuse to issue. | Reserve it for cases where a refusal beats one certificate too many. |
Several issue lines can coexist: each adds an authority to the list. There is no line that removes an authority already allowed elsewhere.
Check your own domain, right now
Enter a domain name: the tool reads its current certificate, its issuing authority and its expiry date.
How an authority climbs the tree
Here is the part that surprises people: the authority does not look only at the name requested. It climbs level by level until it finds a record, and the first one it finds decides on its own.
- 1
The request names a precise host
Say a certificate is requested for the public side of the site.
www.example.com
- 2
The authority queries that exact name
It asks for the CAA records of www.example.com. If it finds any, it stops there and never looks at the levels above.
- 3
Otherwise it climbs one level
No record on the requested name: it queries the parent domain, and so on up to the extension.
www.example.com → example.com
- 4
The first level that answers decides
This is what makes a CAA record on a subdomain stronger than the domain's: it hides the level above completely instead of adding to it.
- 5
It issues, or it refuses
If its identifier appears in the record it found, it issues. Otherwise it refuses flat: no warning, no certificate.
No record at any level means every authority is allowed. That is the default state of the vast majority of domains.
Identifiers for the most common authorities
The value you write is not the authority's trading name but the identifier it publishes. Get it wrong and issuance stops, with nothing to explain why.
| Identifier to write | Authority | Common case |
|---|---|---|
| letsencrypt.org | Let's Encrypt | The automatic certificates on most hosts and on self-managed servers. |
| digicert.com | DigiCert | Commercial certificates, extended validation. |
| sectigo.com | Sectigo | Commercial certificates resold by many hosts. |
| globalsign.com | GlobalSign | Commercial certificates. |
| pki.goog | Google Trust Services | Certificates issued for services hosted at Google. |
| buypass.com | Buypass | An authority that also offers automated issuance. |
This list is not exhaustive and identifiers do change: before publishing, check the value in the documentation of the authority you actually use.
What breaks a certificate issuance
Automatic renewal fails overnight
What causes it: The host switched certificate authority, and the CAA record set two years ago names only the old one.
What fixes it: Add the new authority's identifier. One extra line does it, and the old one can stay while the transition runs.
The wildcard is refused, the plain certificate goes through
What causes it: An issuewild line is present and stricter than the issue line. The moment it exists, it decides for wildcards on its own.
What fixes it: Either add the authority to the issuewild line, or delete that line so the issue rule covers both cases.
The domain's CAA record does not apply to the subdomain
What causes it: A record exists on the subdomain and hides the domain's completely instead of adding to it.
What fixes it: Decide which level the rule lives at and keep only one. A CAA record on the domain covers every name below it that publishes none.
No authority can issue any more
What causes it: A lone semicolon, put there to block issuance during a migration, was never taken out afterwards.
What fixes it: Delete the line, or replace it with the identifier of the authority you use. While it sits there the block is total and silent.
The questions that come next
Does CAA really prevent a fraudulent certificate?
It stops a rule-abiding authority from issuing one. It does not protect against a compromised authority, which will read nothing at all. It narrows the surface rather than locking the door — and it covers almost every trusted authority.
Is a record needed on every subdomain?
No. One record on the domain is enough: it covers every name below that publishes none. Only add one on a subdomain if that subdomain must obey a different rule.
What happens if I have no CAA record?
Every authority is allowed to issue for your domain. Nothing breaks and nothing warns you: the protection simply does not exist.
How long before a change takes effect?
As long as the record's TTL. An authority that has just read the old value may still rely on it until it expires, which matters when you add an authority right before a renewal.
A correct CAA record prevents a failed renewal
The record never expires, but it does go stale: change hosts once and it blocks the very thing it was meant to protect. DomainVigil watches the certificate on every domain you own and warns you before a renewal fails.
Start for freeFive domains free, forever. No card required.
The other reference guides
- SPF: the list of servers allowed to send mail as your domain
- DKIM: the signature that travels with the message
- DMARC: the rule that says what to do when SPF and DKIM fail
- DNSSEC: signed DNS answers, and what it costs when they break
- TTL: how long a DNS answer stays in cache
- A and AAAA: the two ways of saying where a name lives
- CNAME: the DNS alias, and the four things it cannot do
- MX: where a domain's mail goes, and in what order
- WHOIS and RDAP: reading a domain's registration record
- The certificate chain: three links, and the one people forget
- HSTS: forcing HTTPS, and the trap on the way back