---
title: "What is a CAA record?"
canonical: https://enum.co/learn/what-is-a-caa-record
locale: en
topic: Network
publishedAt: 2026-10-20
updatedAt: 2026-10-20
author: "Max Heyer"
summary: "A CAA record is a DNS record that names which certificate authorities may issue TLS certificates for a domain, so other authorities refuse to issue."
---

# What is a CAA record?

A CAA record is a DNS record that names which certificate authorities may issue TLS certificates for a domain, so other authorities refuse to issue.

After reading this you will be able to:

- Explain what a CAA record allows and blocks
- Read the issue, issuewild and iodef tags in a record
- Know how CAs find CAA records for subdomains

## What is a CAA record?

A CAA record (Certification Authority Authorization) is a DNS record that lists the certificate authorities allowed to issue TLS certificates for a domain. Before issuing, a public CA looks up the record. If the CA is not on the list, it must refuse, even when the request passes domain validation.

Think of a guest list at a door. The bouncer still checks your ID, but if your name is not on the list, you stay outside. Domain validation is the ID check, and the CAA record is the list.

## What goes into a CAA record?

Each record has a flags number, a tag and a value. A zone usually holds several records, one per rule:

```
example.com.  3600  IN  CAA  0 issue "ca.example.net"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"
```

- `issue` names a CA allowed to issue certificates for the name.
- `issuewild` applies only to wildcards like `*.example.com`. If present, it replaces `issue` for wildcard requests. The value `";"` means no CA may issue.
- `iodef` gives an address where a CA can report requests it refused.

A flags value of 128 marks a record as critical. A CA that does not understand a critical tag must not issue at all.

### Account and method limits

The `issue` value can carry extra parameters. `accounturi` limits issuance to one account at the CA, and `validationmethods` limits how the CA checks control, for example to `dns-01`. Rely on these only when your CA says it supports them.

## How does a CA find the record?

The CA queries CAA for the exact name in the request, such as `api.shop.example.com`. If that name has no CAA records, it tries `shop.example.com`, then `example.com`, and stops at the first name that has any. If no name up the tree has one, any CA may issue.

The check happens at issuance time only. A CA may reuse a lookup for the record's TTL or 8 hours, whichever is longer. Changing CAA later does not revoke certificates that already exist, and browsers do not check CAA when they connect.

## How enum handles CAA records

[enum DNS](/dns) supports CAA records alongside A, AAAA, CNAME, MX, TXT, NS and SRV, free for every account. CAA can sit at the zone apex next to a flattened CNAME. Turn on DNSSEC for the zone as well, so a CA can verify that the CAA answer it reads is genuine.

## FAQ

**Do I need a CAA record?**
No. Without one, any public CA may issue for your domain after validating control. Adding one shrinks that set to the CAs you actually use, which limits damage from a mistake or attack at another CA.

**Will a CAA record break automatic renewals?**
Only if it leaves out the CA your tooling uses. List every CA that issues for you, including any used for wildcards, before you publish the record, and keep the list current when you switch.

**Does a CAA record apply to subdomains?**
Yes. A CA climbs from the requested name to its parents and uses the first CAA records it finds. A subdomain with its own CAA records follows those instead of the ones at the parent.