CAA Record Generator

Authorize the Certificate Authorities that may issue SSL certificates for your domain

A CAA (Certification Authority Authorization) record is a DNS record that allows you to specify which Certificate Authorities (CAs) are authorized to issue SSL/TLS certificates for your domain.

Select one or more Certificate Authorities below and choose whether each CA may issue standard certificates, wildcard certificates, or both. The generator will create ready-to-use CAA records for your DNS zone.

If no applicable CAA record exists, public Certificate Authorities are generally not restricted by CAA. Once you publish CAA records, however, only the CAs authorized by the applicable records may issue the corresponding certificate type.

How the generated CAA records work

issue authorizes a CA to issue normal certificates. If no issuewild record exists, an issue authorization can also apply to wildcard certificates.

issuewild specifically controls wildcard certificate issuance. Multiple records of the same type are additive, so you can authorize more than one CA.

iodef can contain contact information for reporting CAA policy violations, although not every CA actively sends such reports.

Common DNS providers

Most modern DNS control panels support CAA records, including cPanel, Cloudflare, Amazon Route 53, Google Cloud DNS and many registrar DNS services. The exact field names may differ, but the generated Host, Flags, Tag and Value fields contain the information you need.

CAA records and subdomains

CAA policies can be inherited by subdomains. A more specific CAA record on a subdomain can establish a different policy for that hostname. Always review your existing DNS configuration before publishing restrictive CAA rules.