# What Is CAA Record? Definition and Examples

> A CAA record is a DNS record that lists which certificate authorities may issue certificates for a domain, checked by every public CA before issuance.

Source: https://ssl.sh/glossary/caa/
Last updated: 2026-11-10

A CAA record (Certification Authority Authorization, [RFC 8659](https://www.rfc-editor.org/rfc/rfc8659)) is a DNS resource record naming the CAs allowed to issue certificates for a domain. The issue tag controls ordinary certificates, issuewild controls [wildcard certificates](https://ssl.sh/glossary/wildcard-certificate/), and iodef gives a contact for violation reports. Publicly trusted CAs have been required to check CAA since September 2017; they look up the exact name first and then climb toward the parent domain until they find a CAA record set.

## Why it matters
CAA reduces the risk of [misissuance](https://ssl.sh/glossary/misissuance/) by a CA you do not use, for example if an attacker manages to pass domain validation somewhere else. Under Ballot SC-067 ([MPIC](https://ssl.sh/glossary/mpic/)), CAs must perform CAA lookups from multiple network perspectives, making DNS spoofing harder. RFC 8657 adds the accounturi and validationmethods parameters, which let you restrict issuance to one ACME account or challenge type at CAs that support them.

## Example
```text
example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"
```

These records allow only Let's Encrypt for regular certificates and forbid wildcards. Check what a CA will see:

```bash
dig example.com CAA +short
```

## Common misconceptions
- **Browsers check CAA.** Only CAs check it, at issuance time; it has no effect on existing certificates or on TLS connections.
- **No CAA record means no CA may issue.** The opposite: without CAA, any public CA may issue.
- **Adding CAA for one CA breaks certificates from another.** Existing certificates keep working; only new issuance and renewal at an unlisted CA fail.

## Related terms

- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。
- [DNSSEC](https://ssl.sh/zh/glossary/dnssec/): DNSSEC 是一组 DNS 扩展，让解析器能沿着从根区开始的签名链，验证 DNS 应答确实来自权威方且未被篡改。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。