DNS CAA Record
Sitecheck Team
Specifies which certificate authorities are allowed to issue SSL/TLS certificates for a domain.
A CAA (Certification Authority Authorization) record specifies which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for a domain. If no CAA record exists, any CA may issue a certificate for your domain.
Why it matters: CAA records reduce the risk of mis-issued certificates by preventing unauthorised CAs from issuing certificates for your domain — even if a CA is compromised.
Quick tips:
- Add a CAA record listing only the CAs you use (e.g.
0 issue "letsencrypt.org"). - Use
issuewildto separately control wildcard certificate issuance. - Use
iodefto receive email reports of any unauthorised issuance attempts.