Search... ⌘ K
Get Started Contact Sales

What Is a CAA Record?

Last updated

Table of Contents

What is a CAA record?

A Certification Authority Authorization (CAA) record (record type 257) is a type of DNS record that provides a layer of security for your domain’s SSL certificates. Its primary purpose is to allow domain owners to explicitly declare which Certificate Authorities (CAs) are authorized to issue certificates for their domain or specific hostnames.

A CAA record acts like an allowlist for CAs. It helps prevent mis-issuance of certificates, which could otherwise be exploited for malicious activities like phishing or man-in-the-middle attacks.

How CAA records control certificate issuance

The presence or absence of a CAA record fundamentally changes how CAs issue certificates for your domain:

  • No CAA record present: If no CAA record is configured for a domain or hostname, any CA is allowed to issue a certificate for that domain. This is the default behavior.
  • CAA record(s) present: If one or more CAA records are present for a domain or hostname, only the CAs explicitly listed in those records are allowed to issue certificates for that specific hostname. Publicly trusted CAs are required to check CAA before issuing, and must refuse requests that the records do not allow.

CAA records also provide a mechanism to indicate notification rules. With an iodef record, you can ask CAs to report requests that violate your policy (for example, someone requesting a certificate from a CA you have not allowed) to an email address or URL. CAs are not required to send these reports.

Scope and inheritance

CAA records can define policy for your entire domain or for specific hostnames within it. CAA policies are also inherited by subdomains. For example, a CAA record set on example.com will also apply to www.example.com, blog.example.com, and any other subdomain, unless overridden by a more specific CAA record on the subdomain.

Why CAA records are important for your security

  • Prevents mis-issuance: The primary benefit is stopping CAs you do not use from issuing certificates for your domain, which reduces the risk of someone obtaining a certificate to impersonate your site.
  • Enhances trust: By explicitly controlling who can issue certificates, you add another layer of trust and integrity to your online presence.
  • Compliance: Some industry standards or security best practices may recommend or require the use of CAA records.

A CAA record uses a specific format consisting of flags, a tag, and a value, which together define the authorized CA or the notification policy.

Setting up and understanding CAA record details

If you buy certificates through DNSimple, your CAA records must allow the CA that issues them. See CAA Records and SSL Certificates.

For step-by-step instructions on how to add a CAA record with DNS hosting at DNSimple, please refer to our dedicated How-To Guide: Manage CAA Records.

For a detailed explanation of the CAA record format, accepted tags (issue, issuewild, issuemail, iodef, contactemail, contactphone), their specific values, and various examples, consult our Reference Guide: CAA Record Format and Policy Tags.

Technical details

The specification for the DNS CAA record is formally defined in RFC 8659: CAA Resource Record for DNS.

Have more questions?

If you have additional questions or need any assistance with your CAA records, just contact support, and we will be happy to help.