CAA Records Explained: Controlling Which CA Can Issue Your Certificates
A CAA (Certification Authority Authorization) record is a DNS entry that names the certificate authorities allowed to issue a TLS certificate for your domain. Without one, any publicly trusted CA can issue a certificate for it, no permission required.
Last updated: August 30, 2026
What does a CAA record actually restrict?
It restricts certificate issuance, nothing else. Every publicly trusted certificate authority is required to check a domain's CAA records before issuing, a rule the CA/Browser Forum's baseline requirements have enforced since 2017. If the CA it's using isn't listed, the CA has to refuse the request. A CAA record doesn't affect DNS resolution, doesn't affect existing certificates, and doesn't stop traffic from reaching your servers. It only closes off who's allowed to get a new certificate issued for your name.
How the parent-domain lookup works
When a CA checks CAA for a name it's about to issue for, it doesn't stop at that exact name. If app.example.com has no CAA record of its own, the CA checks example.com next, and keeps walking up toward the root until it finds one or runs out of domain to check. That means a single CAA record published at your apex domain covers every subdomain underneath it that doesn't publish a more specific record of its own.
issue, issuewild, and iodef tags
issue authorizes a CA to issue ordinary certificates. issuewild does the same but specifically for wildcard certificates, and it's checked separately. If you don't publish any issuewild records, your issue records apply to wildcards too. iodef is optional and gives CAs an address, a mailto: or an https: URL, to report to if they see an issuance request for your domain from a CA that isn't authorized.
How to set one up
- List every CA that actually issues certificates for your domain today, including any your host or CDN uses on your behalf.
- Add an
issuerecord for each one using its published CAA hostname (for exampleletsencrypt.orgordigicert.com). - Add
issuewildrecords too if wildcard certificates need a different, narrower set of authorized CAs. - Optionally add an
iodefrecord so you hear about any unauthorized issuance attempt. - Publish it at your domain's apex so it covers every subdomain that doesn't have its own.
- Confirm your next renewal still succeeds before assuming the record is correct.
Common mistakes
- Restricting to one CA while actually using two, your main site through one provider and a marketing landing page or CDN through another.
- Forgetting that
issuewildis checked separately, so wildcard renewals fail even though ordinary certificates keep working. - Publishing
issue ";"by accident, which explicitly forbids every CA from issuing at all. - Restricting CAA before actually confirming which CA your host uses behind the scenes.
See which CAs are already authorized for a domain, with the same parent-domain walk a real CA performs, and build a new record if you don't have one yet.
Frequently asked questions
Do I need a CAA record if I don't manage certificates myself?
It's still worth publishing one. Even if your host or CDN handles certificates for you, a CAA record naming that provider's CA stops anyone else from getting a certificate issued for your domain elsewhere.
What happens if I have no CAA record at all?
Any publicly trusted certificate authority is allowed to issue a certificate for your domain. That's the default the CA/Browser Forum's baseline requirements assume in the absence of a CAA record, not a security failure on its own, but it does mean the decision isn't yours.
Does a CAA record stop someone from serving fake content on my domain?
No. CAA only restricts who can get a valid certificate issued for your domain name. It doesn't touch DNS hijacking, subdomain takeover, or anything happening on infrastructure you don't control. It closes off one specific way an attacker could get a browser-trusted certificate for your name.
Will a CAA record break my existing certificate?
No. CAA is only checked at issuance and renewal time, so an existing certificate keeps working. It only becomes a problem if you publish a record that excludes the CA you actually use, in which case the next renewal will fail.