CAA Record — CAA Record (Certification Authority Authorization)
Specifies which Certificate Authorities (CAs) are permitted to issue TLS/SSL certificates for your domain.
CAA
RFC 8659
3600 seconds (1 hour)
Security & Certificates
BIND Zone File Syntax Example
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";" # Prohibits wildcardsHow to Query & Check CAA Records
dig +short CAA example.comnslookup -type=CAA example.comResolve-DnsName -Name example.com -Type CAARecommended Best Practices
If using Vercel, AWS CloudFront, or Cloudflare, ensure you authorize their respective CAs (e.g. `letsencrypt.org`, `digicert.com`, `amazontrust.com`) to prevent SSL renewal failures.
- •Restricting SSL issuance strictly to Let's Encrypt (`letsencrypt.org`) or DigiCert
- •Forbidding wildcard certificate creation (`issuewild ";"`) to mitigate subdomain hijacking
- •Receiving automated security notifications (`iodef "mailto:security@example.com"`) if unauthorized issuance is attempted
Common Configuration Mistake
Adding a CAA record that excludes your hosting provider's automated SSL issuer, causing HTTPS renewal to fail and triggering browser security warnings.
DNS CAA Record Questions & Answers
Common questions regarding DNS propagation, TTL settings, and zone file syntax.
CAA (Certification Authority Authorization) prevents rogue or compromised Certificate Authorities from issuing fraudulent SSL certificates for your domain. CAs are legally mandated by the CA/Browser Forum to check CAA records before certificate issuance.