Knowledge Base

What Is a CAA Record? Limit Which CA Can Issue SSL for Your Domain

In short: A CAA record is a DNS record that states which certificate authorities (CAs) may issue SSL certificates for your domain. Without a CAA record, any public CA may issue; when you add, for example, CAA 0 issue "letsencrypt.org", only Let's Encrypt may issue. The record reduces the risk of a certificate being obtained from another CA by mistake or with bad intent.

What is a CAA record and what does it do?

CAA (Certification Authority Authorization) is a DNS record type defined in RFC 8659. Certificate authorities check this record before issuing a certificate for a domain, and a CA that is not listed refuses to issue. According to the Let's Encrypt documentation, if there is no CAA record, any public CA may issue. For the other record types, see our DNS records guide; for the certificate itself, see what an SSL certificate is.

How do you write a CAA record?

A CAA record has three parts: CAA <flags> <tag> <value>.

• Flags: Usually 0. The value 128 means "critical": if the CA does not understand the tag, it does not issue.
• Tag: issue authorises normal certificates, issuewild authorises wildcard certificates (*.yourdomain.com).
• Value: The identifier of the authorised CA, written in quotes.

Example: example.org. CAA 0 issue "letsencrypt.org". If you add several CAA records, the permissions add up; each record authorises one more CA. Subdomains use the CAA record closest to them in the name tree: if www.example.org has no record, the record on example.org applies. If you add a CAA record to a subdomain, it replaces the one above it. For names that point elsewhere with a CNAME, the CAA records at the target are also taken into account.

The values in the table come from the Let's Encrypt and Cloudflare documentation. If you use another CA, take the correct value from that CA's own documentation.

Adding a CAA record step by step

1. Find out which CA issued your certificate. Open the certificate details from the padlock in your browser's address bar, or run: openssl s_client -connect example.org:443 -servername example.org </dev/null 2>/dev/null | openssl x509 -noout -issuer. The organisation in the output is the issuing CA.
2. Check existing CAA records. dig example.org CAA +short lists them; empty output means there is no CAA record. Our guide to DNS checks with dig and nslookup explains the command.
3. Find where your DNS is managed. Add the record in the DNS management that your domain's nameservers point to. Our nameserver guide shows how to find it.
4. Add the record. Enter type CAA, name your domain itself, flags 0, tag issue and the CA identifier as the value (for example letsencrypt.org). If you use wildcard certificates, add an issuewild record for the same CA too. If your DNS management has no CAA type, or your DNS is managed by ÇAP Hosting, you can open a support ticket and have the record added.
5. Verify the record. After a few minutes run dig example.org CAA +short again; the output should look like 0 issue "letsencrypt.org".
6. Watch the next renewal. Check that the next certificate renewal succeeds. If your CA is not listed, the renewal fails.

If you use Cloudflare

According to the Cloudflare documentation, when you add any CAA record to a domain that uses Universal SSL, Cloudflare automatically adds CAA records for the CAs it uses. These records do not appear in the dashboard but do appear in dig output, so seeing records you did not add yourself is normal.

Common mistakes

• Wrong CA value: Use the identifier from the CA's documentation, not its brand name.
• Forgetting a second CA: If different services use different CAs, add a separate issue record for each.
• Blocking wildcard certificates: If an issuewild record exists, wildcard certificates can only come from the CAs it lists.
• DNS query errors: Let's Encrypt does not issue if the CAA lookup returns an error or times out; in that case contact your DNS provider.

Frequently Asked Questions