A CAA (Certification Authority Authorization) record lets a domain owner specify which certificate authorities are permitted to issue TLS certificates for that domain. Certificate authorities are required to check CAA records before issuing, making this a policy control that reduces the risk of mis-issuance.
Each CAA record contains a flag, a tag, and a value. The flag field is currently used only to mark a record as critical; the tag defines what the record controls. There are three standard tags:
issuewild record is present, a CA must match it to issue a wildcard; a matching issue record alone is not sufficient for wildcard issuance.mailto: address where the CA should send a report if it receives a certificate request that violates the CAA policy. This is informational and does not block issuance.example.com. 300 IN CAA 0 issue "letsencrypt.org" example.com. 300 IN CAA 0 issuewild "letsencrypt.org" example.com. 300 IN CAA 0 iodef "mailto:security@example.com"
The CA/Browser Forum — the industry body that sets baseline requirements for publicly trusted certificate authorities — made CAA checking mandatory for CAs. Since that requirement took effect, any publicly trusted CA must check CAA records before issuing a certificate and must refuse to issue if the CAA records prohibit it.
If a domain has no CAA records, any CA is permitted to issue. The presence of at least one issue or issuewild record restricts issuance to the listed CAs only.
To prevent any CA from issuing certificates for your domain, publish an issue record with an empty issuer value:
example.com. 300 IN CAA 0 issue ";"
This signals that no CA is authorized to issue, while still being a syntactically valid record. This is useful for domains that should never have TLS certificates issued — for example, internal-only hostnames or domains used purely for DNS delegation.
CAA record lookup for a domain follows a walk up the DNS tree. If the queried name has no CAA records, the CA checks the parent name, then its parent, and so on up toward the root (the search climbs to, but not including, the root). This means a CAA record at example.com covers sub.example.com unless sub.example.com has its own CAA records that override it.
For wildcard certificates specifically: if there is no issuewild record, the CA falls back to checking issue records. If an issuewild record is present (even with an empty value), it takes precedence over issue for wildcard requests. This means you can allow a CA to issue single-name certificates while blocking it from issuing wildcards, or allow wildcards only from a different CA than the one used for regular certificates.
CAA records rely on DNS integrity to be effective. An attacker who can forge DNS responses could replace CAA records with permissive ones, bypassing the restriction. DNSSEC signing of the zone ensures that CAA records cannot be tampered with in transit, making the policy resistant to DNS-level attacks.
Look up the CAA records for any domain
Open DNS Lookup