DNS REFERENCE
What is a CAA Record?
The SSL security record of the Domain Name System, defining which Certificate Authorities are authorized to issue certificates for your domain.
Understanding the Certification Authority Authorization (CAA) Record
A CAA Record (Certification Authority Authorization) is a security-focused DNS record that lets you declare which Certificate Authorities (CAs) are permitted to issue digital SSL/TLS certificates for your domain name.
Historically, anyone could attempt to trick a Certificate Authority into issuing a certificate for a domain they didn't own, leading to potential man-in-the-middle attacks. Under regulations set by the CA/Browser Forum, all Certificate Authorities are now legally required to inspect a domain's CAA records before issuing any certificate. If a CAA record is present and the requesting CA is not listed as authorized, the CA must refuse to issue the certificate.
Structure of a CAA Record
A CAA record is configured using three specific variables: a flag, a tag, and a value.
| Host/Name | Flag | Tag | Authorized CA (Value) |
|---|---|---|---|
| example.com | 0 | issue | "letsencrypt.org" |
| example.com | 0 | issuewild | "sectigo.com" |
| example.com | 0 | iodef | "mailto:security@example.com" |
1. Flags
Flags represent the critical status. A flag of 0 is non-critical. A flag of 1 (critical) means that if a CA encounters a tag they do not understand, they are prohibited from issuing any certificates for the domain.
2. Tags
- issue: Authorizes the CA to issue certificates for single-name domains or subdomains.
- issuewild: Specifically controls who can issue wildcard certificates (e.g.
*.example.com). - iodef (Incident Object Description Exchange Format): Defines an email or URL endpoint where CAs must report any fraudulent or rejected certificate requests.
Query a CAA Record in Real Time
Lookup the CAA configurations for any domain to see which Certificate Authorities are authorized to secure it:
KEY FACTS
Primary Use
Securing domain against unauthorized SSL certificate requests
Enforcement
Mandated globally by the CA/Browser Forum since 2017
Default Behavior
If no CAA record exists, any Certificate Authority can issue certificates
OTHER DNS EXPLANATIONS