How to Add a CAA Record for SSL Certificates

4 years ago

euroSSL

9 minutes

A CAA (Certification Authority Authorisation) record is a DNS record that allows domain owners to specify which Certificate Authorities (CAs) are authorised to issue SSL/TLS certificates for their domain.

Adding a CAA record is not mandatory, but it provides an additional layer of security by helping prevent unauthorised or accidental certificate issuance. With CAA records, you can control which CAs may issue standard SSL certificates, wildcard certificates, or both for your domain.

The DNS CAA record is specified by RFC 6844 and RFC 8659.

In this guide, we’ll explain how CAA records work, their structure, and how to configure them correctly.

What Is a CAA Record?

CAA stands for Certification Authority Authorisation.

A CAA record is a type of DNS Resource Record that tells Certificate Authorities whether they are authorised to issue an SSL/TLS certificate for a particular domain.

For example, if you want only Sectigo to be able to issue certificates for example.com, you can publish a CAA record such as:

example.com. IN CAA 0 issue "sectigo.com"

When a Certificate Authority receives a certificate request, it checks the applicable CAA records before issuing the certificate. If CAA records are present, the CA must respect the authorisation rules they contain.

CAA is currently defined by RFC 8659, which superseded the original RFC 6844 specification.

Why Should You Add a CAA Record?

Without a CAA record, a publicly trusted Certificate Authority can potentially issue a certificate for your domain as long as its validation requirements are successfully completed.

By publishing CAA records, you can restrict certificate issuance to one or more Certificate Authorities of your choice.

This provides several benefits:

Greater control over SSL certificate issuance – you decide which CAs are authorised to issue certificates for your domain.
Additional protection against certificate mis-issuance – an unauthorised CA should refuse to issue the certificate.
Separate control of wildcard certificates – you can define different authorisation policies for standard and wildcard SSL certificates.
Centralised policy through DNS – certificate issuance rules can be managed as part of your domain’s DNS configuration.

CAA records should therefore be considered an additional security mechanism rather than a replacement for the normal domain validation procedures performed by Certificate Authorities.

Structure of a CAA Record

Each CAA record has a flag and a property and is implemented in DNS as a Resource Record (RR) of type 257, with multiple CAA records per domain being allowed. The flag affects the interpretation of the record. The property allows the selection of different types of CAA records.

As of early 2019, only one bit is defined: the English issuer critical flag. If this flag is set, the bit has a significance of 128, this means that CAs that cannot evaluate the entries in the CAA record are not allowed to issue a certificate for the domain.

In addition to the flag, the following three properties are set:

issue
This property allows a CA, which is defined in the value field, to issue a certificate for the affected domain.
issuewild
This property works like the “issue” property, but only for wildcard certificates. For these, the entry takes precedence over the one under issue.
iodef
This property allows the domain owner to optionally provide a contact option for the certification authority. Not all CAs support this property.

CAA Record Examples

Here are some practical examples of CAA configurations for commonly used Certificate Authorities.

CAA Record for Sectigo

To authorise Sectigo to issue SSL certificates for example.com:

example.com. IN CAA 0 issue "sectigo.com"

To authorise Sectigo to issue wildcard SSL certificates:

example.com. IN CAA 0 issuewild "sectigo.com"

CAA Record for DigiCert

To authorise DigiCert to issue SSL certificates:

example.com. IN CAA 0 issue "digicert.com"

For wildcard certificates:

example.com. IN CAA 0 issuewild "digicert.com"

CAA Record for Certum

To authorise Certum to issue SSL certificates:

example.com. IN CAA 0 issue "certum.pl"

For wildcard certificates:

example.com. IN CAA 0 issuewild "certum.pl"

Can You Authorise Multiple Certificate Authorities?

Yes.

A domain can have multiple CAA records, allowing more than one Certificate Authority to issue certificates.

For example:

example.com. IN CAA 0 issue "sectigo.com"
example.com. IN CAA 0 issue "digicert.com"

In this configuration, both Sectigo and DigiCert are authorized to issue certificates for the domain.

You can also create different policies for standard and wildcard certificates:

example.com. IN CAA 0 issue "digicert.com"
example.com. IN CAA 0 issuewild "sectigo.com"

Here DigiCert is authorized for standard certificate issuance, while Sectigo is authorized for wildcard certificates.

CAA records of the same type are therefore additive: publishing a second issue record does not replace the first one.

How to Add a CAA Record to Your DNS

The exact procedure depends on your DNS provider or control panel, but the process is generally similar.

Open the DNS management or DNS zone editor for your domain and create a new DNS record.

Select CAA as the record type and enter the required values.

A typical configuration for authorizing Sectigo would be:

Type: CAA
Name / Host: @ or your domain name
Flag: 0
Tag: issue
Value / Target: sectigo.com

The @ symbol is commonly used by DNS control panels to represent the root domain, although some providers require the domain name itself or an empty Host field.

For a wildcard certificate, you may instead need:

Type: CAA
Name / Host: @
Flag: 0
Tag: issuewild
Value / Target: sectigo.com

Save the record and allow time for the DNS change to propagate.

The terminology and fields shown by DNS control panels can vary slightly between providers. Some interfaces may ask you to enter the complete CAA record, while others provide separate fields for the flag, tag and CA value.

Where Should You Add the CAA Record?

In most cases, CAA records should be configured on the main registered domain, for example:

example.com

CAA authorisation can then apply to its subdomains.

Certificate Authorities determine the applicable CAA policy by looking for CAA records associated with the name for which a certificate is requested. If no applicable record is found at that level, the lookup can continue towards the parent domain.

This means that a CAA policy configured for the main domain can generally protect its subdomains as well, while a more specific CAA record can be used to establish a different policy for a particular subdomain.

For example, you could have a general policy for:

example.com

and a different CAA policy specifically for:

shop.example.com

This can be useful when different services or subdomains use certificates from different Certificate Authorities.

How to Check Your CAA Records

After adding or changing a CAA record, it is a good idea to verify that it is correctly published in DNS before requesting or renewing an SSL certificate.

On systems that provide the dig command, you can query CAA records with:

dig CAA example.com

Alternatively, you can use an online DNS lookup service that supports CAA queries.

The result should display the CAA records currently published for the domain.

Remember that DNS changes are subject to caching and TTL values, so a newly created or modified record may not immediately be visible from every DNS resolver.

What Happens If the CAA Record Is Wrong?

An incorrect CAA configuration can prevent a Certificate Authority from issuing or renewing your SSL certificate.

For example, if your domain contains:

example.com. IN CAA 0 issue "digicert.com"

but you request a certificate from a CA that is not authorised by the applicable CAA policy, the certificate request may fail.

This is particularly important with automatically renewed SSL certificates. A CAA configuration that is correct today must remain compatible with the Certificate Authority used by your automated certificate service.

If certificate issuance unexpectedly fails with a CAA-related error, check:

the CAA records configured for the domain;
CAA records configured on relevant parent domains or subdomains;
whether the CA issuing your certificate is authorised;
whether separate issuewild records affect a wildcard certificate;
whether recent DNS changes have fully propagated.

Generate Your CAA Records Automatically

If you prefer not to create your CAA records manually, you can use our free CAA Record Generator. Simply enter your domain name, select the Certificate Authorities you want to authorise for standard and wildcard SSL certificates, and the tool will automatically generate the correct DNS records for you.

The generator supports the most common Certificate Authorities, including DigiCert, Sectigo, Certum, GlobalSign, Let’s Encrypt, Google Trust Services and others, and also allows you to specify a custom CA.

Generate your CAA records with our free CAA Record Generator

Frequently Asked Questions About CAA Records

Is a CAA record required to obtain an SSL certificate?

No. Domain owners are not normally required to publish a CAA record.

If no applicable CAA record exists, the absence of CAA restrictions does not by itself prevent a Certificate Authority from issuing a certificate after completing its normal validation procedures.

Does a CAA record make my SSL certificate more secure?

CAA does not change the encryption strength of an SSL/TLS certificate.

Instead, it improves control over certificate issuance by restricting which Certificate Authorities are authorized to issue certificates for your domain.

It should therefore be viewed as an additional layer of certificate security and governance.

Can I authorise more than one Certificate Authority?

Yes. You can create multiple CAA records for the same domain.

For example:

example.com. IN CAA 0 issue "sectigo.com"
example.com. IN CAA 0 issue "digicert.com"

This authorises both Certificate Authorities.

Do I need an `issuewild` record for a wildcard certificate?

Not necessarily.

If no issuewild record exists, the applicable issue records also control wildcard issuance.

You should use issuewild when you want to explicitly define which Certificate Authorities may issue wildcard certificates or when you want wildcard certificates to follow a different policy from standard certificates.

Can CAA records apply to subdomains?

Yes. A CAA policy configured at a parent domain can apply to its subdomains when no more specific applicable CAA policy overrides it.

This allows you to define a general certificate issuance policy for your domain while creating exceptions for specific subdomains when necessary.

Can a wrong CAA record prevent SSL certificate renewal?