CAA record: who can issue your certificates?

In principle, any certificate authority (CA) can issue a certificate for your domain. With a CAA record in DNS, you specify which ones are allowed to. Other certificate authorities must then refuse the request.

Check your website now

Why a CAA record?

Since 2017, certificate authorities have been required to check the CAA record before issuing a certificate. If their name isn't in it, they may not issue a certificate for your domain.

That limits the damage if someone tries to get a certificate for your domain from a different certificate authority, or if a certificate authority makes a mistake. It's an extra lock, not a replacement for the rest of your domain's security.

How a CAA record is structured

A CAA record consists of a flag (usually 0), a tag and a value.

issue: the certificate authority allowed to issue certificates, identified by its domain name, such as letsencrypt.org.
issuewild: the certificate authority allowed to issue wildcard certificates (*.example.com). Without issuewild, issue also applies to wildcards.
iodef: an address where certificate authorities can send a report if someone requests a certificate the record doesn't allow. Optional.

Example

If you only use Let's Encrypt and want to receive reports, it looks like this. If you use several certificate authorities, add a separate issue record for each one.

Example CAA records

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

Subdomains and forgotten certificate authorities

A CAA record on your domain also applies to all subdomains, unless a subdomain has its own CAA record. That's why a record on the domain also counts for, say, www.example.com and shop.example.com.

Include every certificate authority that issues certificates for your domain or subdomains: the one your hosting provider uses, the one a CDN such as Cloudflare uses, and Let's Encrypt if you use it yourself. If you forget one, the next renewal with that certificate authority fails and the certificate expires. If in doubt, ask your hosting provider or CDN which certificate authorities they use.

Look up the CAA record yourself

Use dig to look up your domain's CAA records. If you get no answer, check the parent domain as well.

Terminal

dig +short example.com CAA

How SteadyHost rates the CAA record

OK: there's a CAA record, on the domain itself or on a parent domain.
Warning: there's no CAA record, so any certificate authority may issue certificates for your domain.
This check doesn't count toward the score.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.