CAA records are a simple but useful way to improve control over SSL/TLS certificate issuance for your domains. They allow you to specify which Certificate Authorities are authorised to issue certificates, including wildcard certificates, for a domain.
We’ve just updated our complete guide to CAA records with more detailed information, practical examples and step-by-step instructions for configuring CAA records in your DNS.
The updated guide explains how the issue, issuewild and iodef properties work, how to authorise multiple Certificate Authorities, how CAA policies apply to subdomains, and how to check that your records have been published correctly.
Introducing the euroSSL CAA Record Generator
Along with the updated guide, we’ve also released a new free tool: the euroSSL CAA Record Generator.
Instead of building CAA records manually, simply enter your domain and select the Certificate Authorities you want to authorise. The generator creates the appropriate DNS records for you, ready to be added to your DNS configuration.
It supports major Certificate Authorities including Sectigo, DigiCert, Certum, GlobalSign, Let’s Encrypt, Google Trust Services, SSL.com, Amazon and others, as well as custom Certificate Authorities.
You can separately configure authorisation for standard and wildcard certificates, block wildcard certificate issuance, and optionally add an iodef contact address.
A Small DNS Record with an Important Job
CAA records don’t replace the normal validation procedures required to obtain an SSL certificate, but they provide domain owners with an additional layer of control over certificate issuance.
Whether you’re configuring CAA for the first time or just want to check your existing setup, our updated guide and generator should make the process a little easier.
Read the CAA Records Guide or generate your CAA records now.