DNS CAA Record

Sitecheck Team

Specifies which certificate authorities are allowed to issue SSL/TLS certificates for a domain.

A CAA (Certification Authority Authorization) record specifies which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for a domain. If no CAA record exists, any CA may issue a certificate for your domain.

Why it matters: CAA records reduce the risk of mis-issued certificates by preventing unauthorised CAs from issuing certificates for your domain — even if a CA is compromised.

Quick tips:

  • Add a CAA record listing only the CAs you use (e.g. 0 issue "letsencrypt.org").
  • Use issuewild to separately control wildcard certificate issuance.
  • Use iodef to receive email reports of any unauthorised issuance attempts.

See also: DNS, SSL/TLS, DNSSEC.