What Are CAA Records and Why You Might Need Them

Introduction

CAA records, or Certification Authority Authorization records, let a domain owner specify which certificate authorities are allowed to issue SSL/TLS certificates for a domain.

CAA records are optional for many websites, but they can add useful control. They help reduce the risk of unauthorized certificate issuance and can make certificate management clearer for businesses, SaaS platforms and domains with stricter security requirements. However, an incorrect CAA record can also block certificate issuance or renewal.

Quick answer

CAA records

CAA stands for Certification Authority Authorization. It is a DNS record that tells certificate authorities whether they are allowed to issue SSL/TLS certificates for a domain.

example.com. 300 IN CAA 0 issue "letsencrypt.org"

This means Let’s Encrypt is allowed to issue certificates for example.com.

How CAA works

1. A certificate authority receives a certificate request.
2. The CA checks DNS for CAA records on the domain.
3. If no CAA record exists, the CA can continue normal validation.
4. If CAA records exist, the CA checks whether it is authorized.
5. If the CA is not authorized, it should not issue the certificate.
6. If authorized, issuance can continue after normal domain validation.

CAA does not replace domain validation. The CA still needs to verify control of the domain.

Common CAA tags

The issue and issuewild tags are the most important for most website owners.

CAA examples

example.com. 300 IN CAA 0 issue "letsencrypt.org"

example.com. 300 IN CAA 0 issue "digicert.com"

example.com. 300 IN CAA 0 issuewild "letsencrypt.org"

example.com. 300 IN CAA 0 iodef "mailto:security@example.com"

example.com. 300 IN CAA 0 issue "letsencrypt.org"
example.com. 300 IN CAA 0 issue "digicert.com"

dig example.com CAA
dig +short example.com CAA
dig app.example.com CAA

Do you need CAA?

Not every website must publish CAA records. Many small websites work fine without them.

You may want CAA records if:

• You want to restrict certificate issuance to specific CAs
• You manage many domains
• Your organization has security or compliance requirements
• You use one preferred certificate provider
• You want clearer certificate governance
• You issue wildcard certificates
• You want to reduce unauthorized certificate issuance risk

You may not need CAA records immediately if:

• You use simple hosting SSL
• You rely on automatic Let’s Encrypt certificates
• You do not know which CA your provider uses
• You may change SSL providers soon

Why this matters

CAA is especially important to review before certificate migrations, CDN changes, wildcard certificate issuance or hosting provider changes.

How to check CAA

Use CAA Record Checker to see whether your domain publishes CAA records and which certificate authorities are allowed.

Common problems

How to configure CAA

1. Step 1: Identify your certificate authority

   Confirm whether your SSL certificate is issued by Let’s Encrypt, DigiCert, Sectigo, GlobalSign, Google Trust Services, Amazon Trust Services or another CA.

2. Step 2: Check active DNS provider

   Confirm which DNS zone is live by checking nameservers.

3. Step 3: Review existing CAA records

   Check whether current records already restrict certificate issuance.

4. Step 4: Add only required CAs

   Allow the CAs you actually use for SSL issuance and renewal.

5. Step 5: Add issuewild only if needed

   Only allow wildcard certificate issuance if your domain uses wildcard certificates.

6. Step 6: Test certificate issuance

   After updating CAA, verify that your hosting panel, CDN or certificate provider can issue or renew SSL.

7. Step 7: Re-check after provider changes

   Review CAA whenever changing hosting, CDN or SSL providers.

CAA and subdomains

CAA can affect subdomains depending on where records are published and how the CA checks them.

Parent domain:
example.com

Subdomain:
app.example.com

If app.example.com has no CAA record, the CA may check the parent domain’s CAA policy.

Automatic SSL renewal

Automatic SSL systems, such as hosting panel SSL, CDN SSL or Let’s Encrypt automation, can fail if CAA does not allow the CA being used.

Before adding CAA records, check:

• Which CA your hosting provider uses
• Whether your CDN issues its own certificates
• Whether wildcard certificates are needed
• Whether staging and production use different providers
• Whether subdomains use separate SSL services

Frequently asked questions