A CAA record is a DNS entry that lists which certificate authorities may issue certificates for your domain. CAs must check it before issuing. It will not stop a CA that ignores the rules, but it narrows who can mis-issue for you and costs a few minutes to set up.
Why bother
Without CAA records, Let's Encrypt documentation notes, every public CA may issue for any public domain provided it validates control. That is a wide door for a domain you only ever buy certificates for from one or two providers. CAA closes it to the CAs you name.
Syntax
Each record has the form CAA flags tag value.
- Flags are usually 0. A value of 128 sets the critical bit, which tells a CA to stop issuing if it does not understand the tag.
- The tag is usually
issueorissuewild. - The value is a CA identifier, for example
letsencrypt.org.
Example that allows one CA:
example.org CAA 0 issue "letsencrypt.org"
Example that allows one CA for normal names, a different one for wildcards, and restricts the method:
example.org CAA 0 issue "myca.org;validationmethods=dns-01"
example.org CAA 0 issuewild "otherca.com"
issue governs the domain and subdomains, including wildcards unless issuewild records exist. issuewild covers wildcard issuance only. The optional validationmethods parameter restricts the challenge types a CA may use, and accounturi can pin issuance to a specific ACME account.
How lookups work
The CA uses the record closest to the requested name. For www.community.example.org it checks that full name, then community.example.org, then example.org, and stops at the first CAA record found. That allows a subdomain to override the parent. Lookups follow CNAMEs. Several records with the same tag add up, so if any one allows issuance, issuance is allowed.
Common errors
Let's Encrypt checks CAA before every issuance, so you can hit CAA problems even with no records. A lookup failure means the CA cannot confirm what the records say. Typical causes per its documentation are SERVFAIL from DNSSEC validation failures, nameservers that answer unknown record types incorrectly, and firewalls that drop queries for unknown types.
Rollout checklist
- List every CA that currently issues for your domains, including CDNs and hosting platforms that obtain certificates for you.
- Add an
issuerecord for each, then test a renewal in staging if your CA offers one. - Add
issuewildonly if wildcard rules differ. - Consider locking validation methods and ACME account once automation is stable.
- Document the records so the next person does not add a CA without a review.
Quick check
Does CAA protect against a hacked CA?
No. It restricts well behaved CAs. Use certificate transparency monitoring too, covered in what a certificate transparency log is.
Will adding CAA break my CDN certificates?
It can if the CDN's CA is not listed. Add the CA first, then verify renewal.
Sources
Last reviewed: 19 October 2026.
