CAA Record (Certification Authority Authorization)

A CAA record (Certification Authority Authorization, RFC 8659) is a DNS resource record naming the CAs allowed to issue certificates for a domain. The issue tag controls ordinary certificates, issuewild controls wildcard certificates, and iodef gives a contact for violation reports. Publicly trusted CAs have been required to check CAA since September 2017; they look up the exact name first and then climb toward the parent domain until they find a CAA record set.

Why it matters

CAA reduces the risk of misissuance by a CA you do not use, for example if an attacker manages to pass domain validation somewhere else. Under Ballot SC-067 (MPIC), CAs must perform CAA lookups from multiple network perspectives, making DNS spoofing harder. RFC 8657 adds the accounturi and validationmethods parameters, which let you restrict issuance to one ACME account or challenge type at CAs that support them.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

These records allow only Let's Encrypt for regular certificates and forbid wildcards. Check what a CA will see:

dig example.com CAA +short

Common misconceptions

• Browsers check CAA. Only CAs check it, at issuance time; it has no effect on existing certificates or on TLS connections.
• No CAA record means no CA may issue. The opposite: without CAA, any public CA may issue.
• Adding CAA for one CA breaks certificates from another. Existing certificates keep working; only new issuance and renewal at an unlisted CA fail.