Skip to content
Control Plane Labs

CAA record

Declares which certificate authorities are allowed to issue certificates for a domain.

Last updated July 27, 2026

Zone-file example

example.com.   300   IN   CAA   0 issue "letsencrypt.org"

Typical uses

  • Restricting issuance to the one or two CAs you actually use
  • Blocking wildcard issuance separately with issuewild
  • Publishing an iodef address so a CA can report a violating request
  • Satisfying security questionnaires and CIS-style hardening baselines

When it breaks, check

  • CAA is checked at issuance time, so a bad record breaks renewal, not live traffic
  • The lookup climbs the tree, so a record on the parent governs every subdomain below it
  • An empty issue value — issue ";" — forbids all issuance, which is easy to publish by accident
  • CAs must treat a SERVFAIL on the CAA query as a hard failure, so broken DNSSEC blocks issuance

What the CAA record does

CAA narrows the trust model. Without it, any of the hundreds of CAs in a browser root store can issue for your name, and the only thing between you and a misissued certificate is that CA’s own domain validation.

Two properties surprise people. CAA is not enforced by clients, so publishing a record does not invalidate existing certificates and removing one does not fix a handshake failure. And the lookup inherits upward: the search climbs from the queried label toward the root and stops at the first name with a CAA RRset, so a record at example.com governs api.staging.example.com.

Zone-file and wire format

The format is name TTL IN CAA flags tag "value". Flags is an octet whose only defined bit is Issuer Critical: set it to 128 and a CA that does not understand your tag must refuse to issue rather than ignore the record. Almost everyone publishes 0. Registered tags are issue, issuewild and iodef. The RDATA is a flags octet, a tag-length octet, the tag, then the value.

; flags=0, tag=issue: only this CA may issue for example.com
example.com.   300   IN   CAA   0 issue "letsencrypt.org"

; a second CA, because the CDN requests its own certificate
example.com.   300   IN   CAA   0 issue "digicert.com"

; wildcards handled separately; issuewild overrides issue for *.example.com
example.com.   300   IN   CAA   0 issuewild ";"

; where a CA should report a request it refused
example.com.   300   IN   CAA   0 iodef "mailto:security@example.com"

Common uses

The realistic goal is to shrink the set of CAs that can issue for you from “all of them” to “the ones in your renewal pipeline”. Inventory first: a CDN, a load balancer and a mail platform often each obtain a certificate from a different CA, and all need an issue entry. Publishing issuewild ";" is a cheap win if you never use wildcards. Cross-check what has actually been issued with the CT log lookup.

Troubleshooting

The classic failure is silent and delayed. A restrictive record breaks nothing today, because existing certificates keep working; it breaks in sixty days when an unlisted CA tries to renew and is refused. Treat every CAA edit as a change to your renewal path and check it against the actual issuer of each live certificate.

Two mechanical traps. A value of ";" means “nobody”, so a stray semicolon on the issue tag forbids issuance entirely. And CAs fail closed on a lookup error, so DNSSEC breakage at the DS layer blocks issuance.

# what is published here
dig example.com CAA +short

# CAs climb the tree — check every ancestor, not just the exact name
for n in api.staging.example.com staging.example.com example.com; do
  printf '%s -> ' "$n"; dig +short "$n" CAA | tr '\n' ' '; echo
done

# a CA sees a validation failure as a hard stop; confirm the chain validates
delv example.com CAA

The defining RFC

CAA is type 257, defined in RFC 8659, which obsoleted RFC 6844 and rewrote the tree-climbing algorithm in §3. Tags live in the IANA CAA Property Tags registry, and account-scoped issuance is RFC 8657. The obligation to check CAA is not in any RFC: it comes from the CA/Browser Forum Baseline Requirements, which make the check mandatory for every publicly trusted issuer.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types