CAA Records: Controlling Which CAs Can Issue SSL Certificates

Introduction

CAA records are DNS records that tell certificate authorities which companies are allowed to issue SSL certificates for your domain. They are used to reduce the risk of unauthorized certificate issuance and to make certificate issuance rules clearer.

Most domains can work without CAA records, but if CAA records are present, certificate authorities must respect them. A wrong or outdated CAA record can prevent SSL certificates from being issued or renewed, especially after switching SSL providers, hosting platforms or CDN services.

Quick answer

What is a CAA record?

A CAA record is a DNS record that defines which certificate authorities are authorized to issue SSL certificates for a domain.

example.com CAA 0 issue "letsencrypt.org"

In this example, Let’s Encrypt is allowed to issue standard SSL certificates for example.com.

Is a CAA record required?

No, a CAA record is not required for every domain. If a domain has no CAA record, certificate authorities can usually issue SSL certificates after completing normal domain validation.

However, CAA records can be useful when you want to:

• restrict certificate issuance to specific certificate authorities
• reduce accidental issuance by unexpected providers
• support stricter SSL management policies
• receive reports about attempted certificate issuance
• control wildcard certificate issuance separately

For small websites, missing CAA is usually not a critical issue. Incorrect CAA records are often more risky than no CAA record.

How CAA records work

Before issuing an SSL certificate, a certificate authority checks whether the domain has CAA records. If CAA records exist, the authority checks whether it is listed as allowed.

1. A certificate request is made for a domain.
2. The certificate authority checks DNS for CAA records.
3. If no CAA record exists, issuance can continue after normal validation.
4. If CAA records exist, the authority must be listed as allowed.
5. If the authority is not allowed, certificate issuance should be refused.

CAA records can apply to the root domain and may also affect subdomains depending on DNS structure and inheritance.

Common CAA tags

CAA and wildcard certificates

Wildcard certificates cover subdomains such as *.example.com. CAA can control wildcard certificate issuance separately with the issuewild tag.

example.com CAA 0 issue "letsencrypt.org"
example.com CAA 0 issuewild "letsencrypt.org"

If issue allows a certificate authority but issuewild does not, wildcard certificate issuance may still be blocked.

CAA inheritance and subdomains

CAA records can be inherited from parent domains when a subdomain does not have its own CAA record.

Example: If example.com has CAA records and app.example.com has no CAA record, certificate authorities may use the parent domain’s CAA policy when checking app.example.com.

If a subdomain uses a different SSL provider, check whether parent-domain CAA rules allow that provider.

Why this matters

A missing CAA record is usually not an emergency. A wrong CAA record can be a real SSL problem.

How to check CAA records

Use the CAA Record Checker to see whether a domain publishes CAA records and which certificate authorities are allowed.

Common CAA problems

How to configure or fix CAA records

1. Identify your SSL certificate authority

   Find out which certificate authority your hosting provider, CDN or SSL tool uses. Examples may include Let’s Encrypt, DigiCert, Sectigo or Google Trust Services.

2. Check current CAA records

   Use CAA Record Checker to see whether your domain already restricts certificate issuance.

3. Confirm where DNS is hosted

   Check active nameservers and edit CAA records only at the provider controlling the live DNS zone.

4. Add or update the issue tag

   Allow the certificate authority that should issue standard certificates.

   Type: CAA
   Flag: 0
   Tag: issue
   Value: letsencrypt.org

5. Add issuewild if you use wildcard certificates

   If you need wildcard SSL certificates, make sure issuewild allows the correct certificate authority.

   Type: CAA
   Flag: 0
   Tag: issuewild
   Value: letsencrypt.org

6. Remove outdated CA values

   If you changed SSL providers, remove old CAA records that no longer match your current certificate authority.

7. Re-run SSL issuance

   After DNS updates are visible, retry certificate issuance or renewal in your hosting, CDN or SSL platform.

CAA record examples

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

example.com.  3600  IN  CAA  0 issuewild "letsencrypt.org"

example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

dig example.com CAA
dig www.example.com CAA
dig +short example.com CAA

CAA records and hosting/CDN providers

Many hosting and CDN providers issue SSL certificates automatically. If your domain has restrictive CAA records, the provider’s automatic SSL process may fail unless its certificate authority is allowed.

Before enabling automatic SSL, check:

• which CA the provider uses
• whether the domain has existing CAA records
• whether wildcard certificates are required
• whether CAA records exist on parent domains
• whether DNS changes were made at the active provider

If your provider changes certificate authorities, CAA records may need to be updated.

CAA missing vs CAA misconfigured

A missing CAA record usually means certificate authorities can issue certificates after normal validation. This is common and not always a problem.

A misconfigured CAA record is different. It can block the certificate authority you actually use and cause SSL issuance or renewal to fail.

CAA and SSL troubleshooting checklist

If SSL issuance fails, check:

• Does the domain have CAA records?
• Is the issuing certificate authority allowed?
• Is the certificate standard or wildcard?
• Is issuewild required?
• Are you checking the root domain or subdomain?
• Are parent-domain CAA records inherited?
• Were DNS changes made at the active nameserver provider?
• Has DNS cache updated?
• Does the SSL provider show a specific CAA error?

Frequently asked questions