A CAA (Certification Authority Authorization) record is a DNS resource record that specifies which Certificate Authorities (CAs) are allowed to issue TLS/SSL certificates for your domain. Before issuing a certificate, a CA must check your domain's CAA records; if the CA is not listed, it cannot issue a cert for you.
CAA records use three main tags:
issue— authorizes a CA to issue standard (non-wildcard) certificatesissuewild— authorizes a CA to issue wildcard certificates (overridesissuefor wildcards)iodef— specifies a URL (mailto or https) to report policy violations or unauthorized issuance attempts
Here's a practical example:
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issuewild "digicert.com"
example.com. CAA 0 iodef "mailto:[email protected]"
This permits Let's Encrypt to issue standard certificates, DigiCert to issue wildcard certificates, and directs violation reports to your security email.
All publicly trusted CAs have been required to check CAA records since September 2017. If your domain has no CAA record, any CA can issue certificates for it. If you add CAA records, only the listed CAs can issue — this gives you control over who can obtain certificates in your name, reducing the risk of unauthorized certificate issuance. Subdomains inherit their nearest ancestor's CAA policy unless they define their own record.
WarningA CAA record limits which certificate authorities may issue for your domain. List every CA you use — including your ACME/Let's Encrypt provider — or certificate issuance will be refused.