Glossary / CAA record

CAA record (CA authorization)

A CAA record (certification authority authorization) states which certificate authorities are allowed to issue SSL certificates for your domain. It is essentially a whitelist, for example "only Let's Encrypt may issue certificates." It protects the domain from someone getting a rogue or fraudulent certificate.

Before issuing a certificate, a well-behaved certificate authority checks the domain's CAA record. If its name is not listed, it refuses. This lets the domain owner centrally control who is even allowed to make HTTPS certificates for it.

The record carries a tag (issue for regular certificates, issuewild for wildcards) and the authority's name, such as letsencrypt.org. You can add several CAA records for several allowed providers. The iodef tag also lets you give an address for reports of unauthorized issuance attempts.

CAA is optional: without it, any authority may issue. But it is recommended for security, especially on large domains. Just do not forget your own authority: if letsencrypt.org is missing from CAA, AutoSSL renewals will stop working.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Common mistakes

• Adding CAA but forgetting your own authority, so AutoSSL or Let's Encrypt can no longer renew the certificate.
• Thinking CAA itself encrypts the site; it only permits issuance, while the certificate provides HTTPS.
• Confusing issue with issuewild and accidentally forbidding wildcard certificates.
• Misspelling the authority (letsencrypt.org, not letsencrypt.com), which blocks issuance.

Related terms

• A record A record (DNS address record)
• AAAA record AAAA record (DNS IPv6 record)
• CNAME record CNAME record (DNS alias)
• MX record MX record (mail exchanger)
• TXT record TXT record (DNS text record)