Skip to content
Webmaster Tools
DNS & domainsDNS LookupCAA record

CAA record

What a DNS CAA record is, how the issue, issuewild and iodef tags work, real setups for Let's Encrypt and other CAs, and how to check CAA with dig.

What it is

A CAA (Certification Authority Authorization) record lists which certificate authorities may issue TLS certificates for a domain. It's defined in RFC 8659 (which replaced RFC 6844). Since September 2017 the CA/Browser Forum Baseline Requirements oblige every publicly trusted CA to look up CAA before issuing, and to refuse if the record exists and doesn't name it. With no CAA record at all, any CA may issue.

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issue "pki.goog"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

This allows Let's Encrypt and Google Trust Services to issue normal certificates, forbids wildcard certificates from anyone, and asks CAs to report refused requests by email.

The fields

Each record has a flag, a tag and a value.

Part Meaning
Flag 0 normally. 128 marks the tag critical: a CA that doesn't understand it must not issue
issue A CA domain allowed to issue any certificate for this name (and, without issuewild, wildcards too)
issuewild Overrides issue for wildcard certificates only
iodef Where a CA may report a refused or suspicious request (mailto: or https: URL)
Value ";" An empty issuer: nobody may issue for that tag

Several issue records add up: each one names one more allowed CA. A value can carry parameters after a semicolon, such as "letsencrypt.org; validationmethods=dns-01" or an accounturi (RFC 8657) that pins issuance to one ACME account.

CAs search up the tree: for www.shop.example.com they check that name, then shop.example.com, then example.com, and use the first CAA record set they find. A CAA at the apex therefore covers every subdomain unless a subdomain has its own. If the name is a CNAME, the CA follows it and checks the target.

Common setups

  • Let's Encrypt: 0 issue "letsencrypt.org".
  • Google Trust Services (used by Google Cloud and many Cloudflare certificates): 0 issue "pki.goog".
  • DigiCert: 0 issue "digicert.com"; Sectigo: 0 issue "sectigo.com"; Amazon (ACM): 0 issue "amazon.com" (Amazon also accepts amazontrust.com, awstrust.com and amazonaws.com).
  • Cloudflare: with Universal SSL, Cloudflare adds the CAA records its CAs need automatically when you already have CAA records, so your own list doesn't break edge certificates.

How to check it

Our DNS Lookup can't query CAA records, so use dig:

dig example.com CAA +short
dig www.example.com CAA +short

On Windows, nslookup -type=CAA example.com works on recent versions; older ones print the record as raw data. An empty answer means no CAA at that name: check the parent names too, since that's where the CA will look next. Confirm what a site actually ended up with in the SSL Checker.

Common mistakes

  • Adding a CAA for one CA and forgetting another service that also issues for you (a CDN, an email provider's hosted pages, a load balancer), which then fails to renew.
  • Setting issuewild ";" and later needing a wildcard certificate.
  • Typing the CA's brand name instead of its CAA domain ("Let's Encrypt" won't match).
  • A DNS provider that returns SERVFAIL for CAA queries: CAs treat lookup errors as a reason to refuse.
  • TXT record: where ACME dns-01 challenges are published (_acme-challenge).
  • CNAME record: CAA checks follow aliases to the target.
  • SOA record: the zone's authority and negative-caching TTL.
  • DNS TTL: how long a new CAA record may take to be seen.