CAA Records: A Simple Safeguard That Locks Down SSL Issuance

A CAA (Certification Authority Authorization) record is a DNS entry that names exactly which certificate authorities are allowed to issue SSL/TLS certificates for your domain. Publish one, and every compliant CA is required to refuse a certificate request from anyone else — closing a gap most domain owners never knew was open.

Since September 2017 the CA/Browser Forum has required all publicly trusted certificate authorities to check CAA records before issuing. That single line of DNS turns "any of dozens of CAs can vouch for my domain" into "only the ones I named." This guide explains what CAA records do, the subtle attack they block, and how to add them without breaking your renewals.

What CAA records do

A CAA record lives in your domain's DNS zone alongside your A, MX and TXT records. Its job is narrow: it publishes the list of certificate authorities you have authorized to issue TLS/SSL certificates for the domain, and any CA that follows the rules must read that list before it signs a certificate.

The key detail is when the check happens. A CAA record is read by the CA at the moment a certificate is requested or renewed — not by your visitors' browsers when they connect. It is a control on issuance, not on live traffic. That means adding one has zero effect on certificates you already hold and cannot break a working site; it only governs who may mint new certificates going forward.

Checking is no longer optional. Before the CA/Browser Forum made it mandatory, CAA support was rare and largely ignored. Today, honoring your CAA record is part of the baseline requirements every trusted CA agrees to follow.

The overlooked attack vector CAA records close

Your browser trusts dozens of root certificate authorities. Without a CAA record, any one of them can issue a valid, browser-trusted certificate for your domain — and your visitors would see the padlock either way. Your certificate security is only as strong as the weakest CA in the entire trusted pool.

This is not hypothetical. In 2011 the Dutch authority DigiNotar was breached and used to issue fraudulent certificates for major domains, which were then used to intercept encrypted traffic. Other CAs have mis-issued certificates through validation bugs or social engineering. In each case the domain owner had done nothing wrong — the weakness lived in a CA they had never chosen to work with.

A CAA record shrinks that attack surface from "every CA on earth" down to the one or two you actually use. If an attacker tricks or compromises some unrelated authority, that authority is now obligated to read your CAA record, see it is not on the list, and refuse. CAA does not make mis-issuance impossible, but it removes the easiest path to it.

Anatomy of a CAA record

A CAA record has three parts: a flag byte, a tag, and a value. There are three tags you will use:

• issue — authorizes a CA to issue certificates for the domain and its subdomains. A typical value is letsencrypt.org.
• issuewild — applies specifically to wildcard certificates such as *.example.com, and overrides issue for wildcards when present.
• iodef — an address (mailto: or https://) where a CA should report a blocked or attempted unauthorized issuance, so you actually hear about an attack.

A typical set reads: 0 issue "letsencrypt.org", 0 issuewild "letsencrypt.org", and 0 iodef "mailto:[email protected]". The leading 0 is the flag; setting it to 128 marks the tag "critical," meaning a CA that does not understand it must refuse to issue rather than proceed.

Two special values are worth knowing. An empty issue value — issue ";" — forbids all issuance, which is ideal for a parked domain that should never have a certificate. And you can authorize several CAs simply by adding more issue records, one per authority.

Pinning the CA, the account, and the method

CAA can go further than naming a CA. A later specification adds parameters that let you tie issuance to a specific account and validation method at that authority:

• accounturi — locks issuance to one ACME account, so even someone using the same CA cannot obtain a certificate under a different account.
• validationmethods — restricts which challenge types are accepted, for example only dns-01, blocking easier-to-spoof HTTP validation.

A hardened record might read 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/12345; validationmethods=dns-01". Support for these parameters varies by CA, so test before you depend on them.

How to add CAA records to your domain

1. Inventory your CAs. List every authority that issues certificates for you — your CDN (Cloudflare, Fastly), your host or load balancer (AWS uses amazon.com, Google uses pki.goog), and any manual certificates (Let's Encrypt, DigiCert, Sectigo, GlobalSign). Miss one and its renewals will silently fail.
2. Add the records at your DNS provider using the issue, issuewild and iodef tags above. Most control panels offer a dedicated CAA record type; a few require the raw format.
3. Verify. Query it yourself with dig CAA yourdomain.com, or use a public CAA test tool, then confirm a certificate renewal still succeeds.

The whole change is a handful of DNS lines, costs nothing, and can be rolled back instantly by deleting the records — one of the cheapest security wins you will ever make.

Mistakes that quietly break renewals

• Forgetting a CDN or platform CA. The classic failure: you lock the domain to Let's Encrypt, then your CDN's certificate cannot renew because its authority was never authorized.
• Ignoring wildcards. If you rely on *.example.com certificates but set only issue, some configurations still block the wildcard. Add issuewild explicitly.
• Subdomain surprises. CAA checks climb from the exact hostname up through parent domains, so a record on example.com covers api.example.com unless a more specific record overrides it. Plan the hierarchy deliberately.
• Skipping DNSSEC. An attacker who can spoof your DNS could strip the CAA record before a CA reads it. Signing your zone with DNSSEC protects the record's integrity and makes the whole control trustworthy.

Where CAA fits in your domain security stack

A CAA record is one layer. It pairs naturally with the controls that protect the domain itself: authenticator-app 2FA (never SMS) on your registrar account, a registrar lock against unauthorized transfers, a registry lock for high-value names, DNSSEC to sign your zone, and a recovery email on a separate domain. CAA guards who can certify your name; these guard who can move or repoint it.

All of this depends on managing DNS somewhere capable. For at-cost registration, Porkbun (around $11) and Cloudflare (roughly at wholesale) are the cheapest all-round choices. When you also want a premium, brandable name, Atom.com is a strong option: it is a curated marketplace where each listing ships with a free AI appraisal, a USPTO trademark check, secure escrow, and a professionally designed logo — and Atom also provides registrar services, so you can register an available domain, set nameservers, manage forwarding, and enable DNSSEC on the same platform. Whether you register a fresh domain or acquire a brandable one, add the CAA record on day one. It takes minutes, costs nothing, and never expires.

Frequently asked questions

Do CAA records make my website more secure for visitors?

Indirectly. CAA is enforced at certificate issuance, not when a visitor connects, so browsers never read it. Its value is preventing a certificate from being issued for your domain by an authority you never approved — which stops a whole class of impersonation and traffic-interception attacks before they can begin.

Will adding a CAA record break my existing SSL certificate?

No. CAA is only checked when a new certificate is requested or renewed, so certificates you already hold keep working. The one risk is a future renewal failing if you forgot to authorize a CA you actually use, so inventory every authority — including your CDN and host — before you publish the record.

Which certificate authorities should I list in my CAA record?

List every authority that issues certificates for you. Common values are letsencrypt.org, digicert.com, sectigo.com, globalsign.com, pki.goog for Google, and amazon.com for AWS. Check your current certificate and your hosting or CDN provider's documentation, and include any backup CA you might switch to later.

Is a CAA record a replacement for DNSSEC or a registrar lock?

No — they protect different things. CAA controls who can issue certificates; DNSSEC protects the integrity of your DNS answers, including the CAA record itself; registrar and registry locks stop unauthorized transfers. Use them together as layers rather than treating any one as a substitute for the others.

Where do I add a CAA record, and does it cost anything?

You add it wherever your domain's DNS is managed — your registrar or DNS provider — as a record of type CAA. It is free and takes minutes. At-cost registrars like Porkbun and Cloudflare handle it well, and Atom.com is a good choice when you also want a premium, brandable name with appraisal, trademark check, escrow and DNS management on one platform.