CAA records: decide who may issue certificates for your domain
Without a CAA record, any public certificate authority may issue a certificate for your domain. One DNS record narrows that to the ones you actually use.
Offensly Team··2 min read
Every public certificate authority must look up your domain's CAA records before it issues a certificate. If there are none, the answer is simple: any of them may issue. A CAA record turns that into a short list you choose.
How it works
A CAA record names the authorities allowed to issue for a domain. Since 2017, checking it has been mandatory for every publicly trusted CA. The authority looks at the exact name first and then walks up the tree, so a record on example.com also covers www.example.com and app.example.com unless a subdomain has its own.
Three tags matter in practice:
| Tag | Meaning |
|---|---|
issue | Who may issue ordinary certificates. |
issuewild | Who may issue wildcard certificates such as *.example.com. Falls back to issue when missing. |
iodef | Where a CA may report a request it refused. |
A typical record for a site on Let's Encrypt that never uses wildcards:
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issuewild ";"
example.com. CAA 0 iodef "mailto:security@example.com"The value ";" means nobody, so no CA may issue a wildcard certificate.
For the business
A certificate for your domain lets whoever holds it impersonate your site to browsers. CAA does not stop an attacker who already controls your DNS, but it removes the many authorities you never use from the picture. It costs one DNS change and nothing to run.
Before you publish one
- List every certificate you have. Your web host, CDN, load balancer, email service and any SaaS on a custom domain may each get certificates from a different authority. Certificate Transparency logs show what was issued for your names.
- Include your CDN's authorities. Some providers rotate between several CAs. Their documentation lists the values to allow, and some add them for you when they see a CAA record.
- Publish, then watch renewals. A missing authority shows up as a failed renewal, not as an outage on day one, so check the next renewal of each certificate.
Check it
CAA is part of the advanced DNS check in the free Offensly account, together with DNSSEC, DANE and STARTTLS on your mail servers. It runs on domains you have verified with a DNS record. The basic email check on the homepage needs no sign-up.
Check your own domain in seconds
The free check reads your SPF, DKIM, DMARC and MX records and tells you exactly what to fix. No sign-up.