What is a CAA record?

What is a CAA record?

A CAA record (Certification Authority Authorization) is a DNS record that lists the certificate authorities allowed to issue TLS certificates for a domain. Before issuing, a public CA looks up the record. If the CA is not on the list, it must refuse, even when the request passes domain validation.

Think of a guest list at a door. The bouncer still checks your ID, but if your name is not on the list, you stay outside. Domain validation is the ID check, and the CAA record is the list.

What goes into a CAA record?

Each record has a flags number, a tag and a value. A zone usually holds several records, one per rule:

example.com.  3600  IN  CAA  0 issue "ca.example.net"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

• issue names a CA allowed to issue certificates for the name.
• issuewild applies only to wildcards like *.example.com. If present, it replaces issue for wildcard requests. The value ";" means no CA may issue.
• iodef gives an address where a CA can report requests it refused.

A flags value of 128 marks a record as critical. A CA that does not understand a critical tag must not issue at all.

Account and method limits

The issue value can carry extra parameters. accounturi limits issuance to one account at the CA, and validationmethods limits how the CA checks control, for example to dns-01. Rely on these only when your CA says it supports them.

How does a CA find the record?

The CA queries CAA for the exact name in the request, such as api.shop.example.com. If that name has no CAA records, it tries shop.example.com, then example.com, and stops at the first name that has any. If no name up the tree has one, any CA may issue.

The check happens at issuance time only. A CA may reuse a lookup for the record’s TTL or 8 hours, whichever is longer. Changing CAA later does not revoke certificates that already exist, and browsers do not check CAA when they connect.

How enum handles CAA records

enum DNS supports CAA records alongside A, AAAA, CNAME, MX, TXT, NS and SRV, free for every account. CAA can sit at the zone apex next to a flattened CNAME. Turn on DNSSEC for the zone as well, so a CA can verify that the CAA answer it reads is genuine.

FAQ

Do I need a CAA record? No. Without one, any public CA may issue for your domain after validating control. Adding one shrinks that set to the CAs you actually use, which limits damage from a mistake or attack at another CA.

Will a CAA record break automatic renewals? Only if it leaves out the CA your tooling uses. List every CA that issues for you, including any used for wildcards, before you publish the record, and keep the list current when you switch.

Does a CAA record apply to subdomains? Yes. A CA climbs from the requested name to its parents and uses the first CAA records it finds. A subdomain with its own CAA records follows those instead of the ones at the parent.