CAA record

A CAA record (Certification Authority Authorization) is a DNS zone entry that specifies which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for a given domain. It is a defensive mechanism: it reduces the risk that an unauthorized or misbehaving authority will issue a certificate for someone else's domain.

What a CAA record involves

A CAA entry ties a domain to a certificate authority's name and consists of three elements:

• flag — usually 0; the criticality value of the entry,
• tag — issue (regular certificates), issuewild (wildcard certificates) or iodef (an address for reporting violations),
• value — the domain of the authorized CA, e.g. letsencrypt.org.

Per the standard, every certificate authority must check a domain's CAA records before issuing a certificate. If its name is not on the list, the request is rejected. To make the entry trustworthy, it is worth combining CAA with DNSSEC, which protects the zone from being forged.

The CAA record in practice

You add a CAA record to keep discipline over who issues certificates for your company domains — for example limiting issuance to a single trusted authority such as Let's Encrypt or a commercial provider. The entry is configured in the DNS panel; just remember that too narrow a list will block automatic certificate renewal by another tool. It is a simple, often overlooked piece of domain security hygiene.