Skip to content
DevLab

🔐 CAA Records

CAA (Certification Authority Authorization) is a mechanism for declaring through DNS which Certificate Authorities are authorized to issue SSL/TLS certificates. It helps reduce the risk of mis-issuance. We display all three tags: issue, issuewild, and iodef.

100% Free No signup Server-side No logs / DB Rate-limited 5 languages Dark mode

⚠️ Requests are made from DevLab servers. Private IP addresses and localhost are not allowed.

📖 What this check tells you

A CAA record is a DNS declaration of which certificate authorities may issue for your domain. Under the CA/Browser Forum Baseline Requirements, a CA is obliged to check CAA immediately before issuing. This check reads that record along with the parent-domain CAA it may inherit from. Note that it has no power to revoke certificates that already exist — detecting mis-issuance is what Certificate Transparency logs are for.

Item What it means How to fix it
No CAA record Its absence is not an error, but it means any CA in the world is free to issue. Nothing in the system stops a certificate coming from an authority you never intended to use. Conversely, a single CAA line is enough to narrow that down. Write the identifier of the CA you actually use, in the form example.com. IN CAA 0 issue "letsencrypt.org". Get the identifier wrong and your next renewal fails silently until the certificate expires. Common values are letsencrypt.org, digicert.com, sectigo.com, pki.goog and amazon.com — always confirm against the CA official documentation.
issuewild not specified When issuewild is absent, the issue value applies to wildcards as well — meaning any CA you allow under issue can also issue *.example.com. A single leaked wildcard certificate impersonates every subdomain at once, so if you do not need them, forbidding them explicitly is worth the line. If you do not use wildcards, write example.com. IN CAA 0 issuewild ";". A lone semicolon means no CA is permitted. To allow just one authority, write it as 0 issuewild "digicert.com".
The parent domain CAA applies CAA lookup walks up the tree until it finds a record. With nothing on shop.example.com, the record on example.com governs it. This inheritance is what causes the classic stall where a subdomain needs a different CA but issuance keeps being refused. To use a different CA on a subdomain, place a CAA record on that subdomain itself — once a child has any record, the parent is not consulted. When issuance fails with a message about CAA preventing it, inheritance is the first thing to check. Note too that when the name is a CNAME, CAA is evaluated at the CNAME target.

CAA itself travels in plaintext DNS, so an attacker who can spoof DNS can spoof CAA too. To make it a real defence, pair it with DNSSEC. Note also that CAA is a mechanism for preventing issuance, not for noticing mis-issuance. If you want to know what certificates actually exist for your name, subscribing to Certificate Transparency logs — monitoring crt.sh, or a notification service such as Cert Spotter — is the only reliable route.

🔗 Related Tools