The CAA record explained: one line that stops any CA issuing for your domain

There are roughly a hundred publicly trusted certificate authorities in the world. Browsers trust all of them.

By default, any one of them can issue a valid HTTPS certificate for your domain. Not just the one you use. All of them. A certificate authority you have never heard of, in a country you have no dealings with, can issue a certificate for your domain, and every browser on earth will accept it as genuine.

A CAA record is the one-line DNS entry that says no.

What CAA does

CAA stands for Certification Authority Authorization. It is a DNS record naming the certificate authorities permitted to issue for your domain.

yourcompany.com.  CAA  0 issue "letsencrypt.org"
yourcompany.com.  CAA  0 issuewild "letsencrypt.org"
yourcompany.com.  CAA  0 iodef "mailto:security@yourcompany.com"

Certificate authorities are required to check this record before issuing, under the CA/Browser Forum baseline requirements that govern public trust. A CA that finds your CAA record naming somebody else must refuse the request. This is not advisory; ignoring it is grounds for a CA losing its trusted status.

The three property tags:

• issue — which CAs may issue ordinary certificates for this domain.
• issuewild — which CAs may issue wildcard certificates (*.yourcompany.com). Worth setting separately, since wildcards are more dangerous if misissued.
• iodef — where to report a refused request. Set this and you get told when somebody tries.

To forbid issuance entirely, use an empty value:

yourcompany.com.  CAA  0 issue ";"

Why this matters more than it sounds

The threat is not theoretical. Certificate authorities have misissued certificates before, through compromise, through social engineering of their validation process, and through simple error. Several have been removed from browser trust stores as a result.

If someone obtains a certificate for your domain from any trusted CA, they can operate a convincing site with a valid padlock. Combined with a DNS hijack, which is what DNSSEC defends against, that is a complete, warning-free impersonation of your business.

CAA reduces the surface from “any CA on earth” to “the one or two we actually use”. It does not eliminate the risk, but it turns a hundred possible points of failure into two you have chosen.

The iodef tag adds something quietly valuable: notification. If an attacker attempts to obtain a certificate for your domain from a CA you have not authorised, you find out. Without CAA, that attempt is invisible to you.

What to watch out for

Get the CA identifier exactly right. It is the CA’s own published identifier, not their marketing name. letsencrypt.org, digicert.com, sectigo.com, globalsign.com, pki.goog for Google Trust Services, amazon for AWS Certificate Manager. Getting it wrong means your renewals start failing.

Account for everything that issues on your behalf. Your CDN, your hosting panel, your load balancer and your email provider may each obtain certificates automatically through different CAs. List every one before you publish, or something will fail to renew in ninety days, long after you have forgotten you made the change.

Understand the tree walk. If a CA finds no CAA record on shop.yourcompany.com, it walks up to yourcompany.com and uses that. So a record at your apex covers subdomains that do not have their own. Set a subdomain’s own record and it overrides the parent completely rather than adding to it.

Publish before you need it. CAA is checked at issuance time, so it does not affect existing certificates. It applies from the next issue or renewal.

Setting it up

At Cloudflare, Route 53, Google Cloud DNS and every other modern provider, CAA is a record type in the same interface as your A and MX records. If your provider does not support CAA in 2026, that is a reasonable prompt to move.

A sensible starting position for most businesses:

1. Find out which CA currently issues your certificates. Your browser will tell you: click the padlock and view the certificate.
2. Check whether anything else issues on your behalf. CDN, host, load balancer, mail provider.
3. Publish issue and issuewild records naming those CAs.
4. Add an iodef pointing at a monitored mailbox.
5. Confirm your next renewal completes normally.

That is twenty minutes of work, once, at no cost.

Almost nobody has one

Of the domains we check, the overwhelming majority have no CAA record at all. Not because it is difficult or expensive, but because nothing prompts you to add one. No dashboard warns you. No provider nags. It sits in the same category as DNSSEC: free, quick, genuinely useful, and invisible unless somebody goes looking.

The free domain security checker checks your CAA record, along with DMARC, SPF, DNSSEC and more, in about twenty seconds. It runs in your browser, requires no signup, and stores nothing. If your domain comes back clean we will tell you so.

If you would rather we handled the DNS side properly, that is part of our Cloudflare, DNSSEC and WAF engagement.