Understanding CAA Records: Securing Your Domain Against Unauthorized Issuance

DNS Certification Authority Authorization (CAA) is an Internet standard (RFC 6844) that allows domain owners to specify which Certificate Authorities (CAs) are authorized to issue digital certificates for their domain names.

Despite being a mandatory check for public CAs since 2017, CAA records remain underutilized by many organizations.

Why CAA Records Matter

Without a CAA record, any publicly trusted Certificate Authority can issue an SSL/TLS certificate for your domain as long as domain validation checks pass. If a CA suffers a breach, a validation loophole, or a misconfiguration, an attacker could request a valid certificate for your domain from an unauthorized CA.

By publishing a CAA record in your DNS zone, you restrict certificate issuance exclusively to your approved providers (e.g., Let's Encrypt, DigiCert, Section).

Structuring CAA DNS Records

A CAA record consists of three main fields: flags, tag, and value.

Here are standard examples:

Restricting Issuance to Specific CAs

To allow only Let's Encrypt and DigiCert to issue certificates for example.com:

`dns
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 issue "digicert.com"
`

Wildcard Certificates (issuewild)

If you want to allow Let's Encrypt for standard hostnames, but restrict wildcard certificate issuance (*.example.com) solely to DigiCert:

`dns
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 issuewild "digicert.com"
`

Misconfiguration Reporting (iodef)

You can also specify an email address or HTTP endpoint where CAs must report unauthorized certificate requests:

`dns
example.com. IN CAA 0 iodef "mailto:security@example.com"
`

Validate Your CAA & DNS Setup with CertificateGuardian

CertificateGuardian includes free diagnostic tools and continuous monitoring for your DNS and CAA posture. Test your CAA setup instantly with our DNS & CAA Record Lookup tool or configure automatic alerts whenever CAA records change.