Configure
CAA record generator
Choose which certificate authorities may issue for your domain and get CAA records ready for your DNS provider.
Runs in your browser Everything you enter is processed locally with JavaScript and is never uploaded to ssl.sh.
The CAA generator writes DNS records that tell certificate authorities which of them may issue certificates for your domain. Tick the CAs you use, decide how wildcard certificates are handled, and copy the result in the format of your DNS provider. The tool runs in your browser.
How to use it
- Enter the domain and the host record (
@for the domain itself, or a subdomain label). - Tick the CAs that may issue, and add any other CA identifier in the text box.
- Choose the wildcard policy: same as above, forbid wildcards, or allow only specific CAs.
- Optionally add an
iodefaddress (mailto:orhttps:) and a Let's Encryptaccounturi. - Copy the BIND lines, or the Cloudflare, Alibaba Cloud or DNSPod values, into your DNS.
Example output:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"
How the rules combine
issuelists CAs for all certificates. Severalissuerecords mean any of those CAs may issue.issuewild, if present, replacesissuefor wildcard certificates.issuewild ";"forbids wildcards entirely.- With no CAA records at all, any CA may issue. A record on
example.comalso covers subdomains that have no records of their own.
Before you publish
- Find all certificates for the domain with CT search and note every issuing CA, including those used by your CDN.
- Publish the records, wait for the TTL, then check them with the CAA checker.
- If a renewal fails with a CAA error, see CAA record prevents issuance.
FAQ
Which CA identifier should I use?
The one your CA documents. Reseller brands use the identifier of the CA that actually issues: for example PositiveSSL certificates are issued by Sectigo (sectigo.com), and RapidSSL and GeoTrust by DigiCert (digicert.com). Check the issuer of your current certificate with the certificate decoder.
I use Cloudflare. Do I need to add Cloudflare's CAs?
Cloudflare's documentation says that when you add CAA records, it automatically adds records for the CAs it uses for Universal SSL, so its edge certificates keep renewing. Add your own CAs for certificates you request yourself.
What does accounturi do?
It limits issuance to one ACME account at the CA (RFC 8657). Even if someone else passes domain validation, they cannot get a certificate from another account. Find your Let's Encrypt account URL in your ACME client's account files.
Can CAA break my renewals?
Yes, if you forget a CA you still use. Before publishing, list every certificate for the domain (including those from your CDN or hosting provider) and include all their CAs.