How do CAA records improve security?

CAA records reduce the risk of certificate mis-issuance. If a CA receives a certificate signing request for a domain, it must check for CAA records and refuse to issue if the record does not authorize it. This protects against rogue CA issuance and man-in-the-middle attacks.

What is the difference between issue and issuewild CAA tags?

The "issue" tag authorizes a CA to issue regular (non-wildcard) certificates for the domain. The "issuewild" tag specifically controls wildcard certificate issuance (e.g., *.example.com). You can authorize different CAs for each type.

CAA Records

CAA (Certification Authority Authorization) records allow domain owners to specify which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for their domain.

Why Use CAA Records?

CAA records add an extra layer of security to your domain by preventing unauthorized certificate authorities from issuing certificates. This helps protect against:

Accidental certificate issuance by unknown CAs
Man-in-the-middle attacks
Certificate misissuance

CAA Record Format

example.com.    CAA    0 issue "letsencrypt.org"
example.com.    CAA    0 issuewild "letsencrypt.org"
example.com.    0 iodef "mailto:[email protected]"

CAA Flags

0 - Non-critical (most common)
128 - Critical — CA must understand to proceed

CAA Tags

issue - Authorize specific CA to issue certificates
issuewild - Authorize CA for wildcard certificates
iodef - URL/email to report violations

Testing CAA Records

Use our CAA Lookup tool to verify your CAA records are correctly configured.

Try it on your domain

See the theory in practice — run a CAA Lookup for your own domain.