CAA record
What is CAA record?
A CAA (Certification Authority Authorization) record is a DNS entry naming which certificate authorities may issue TLS certificates for a domain; without one, any publicly trusted CA can issue if it passes that CA's own validation. AdminKit's DNS lookup tool checks a domain's records, including CAA.
By AdminKit team, Netbase JSC · Updated
A CAA (Certification Authority Authorization) record, defined in RFC 8659, is a DNS entry that specifies which certificate authorities are permitted to issue TLS/SSL certificates for a domain. Without one, any publicly trusted CA can issue a certificate for the domain if it passes that CA’s own validation; with a CAA record in place, CAs are required by the CA/Browser Forum’s baseline requirements to check it and refuse to issue a certificate if they aren’t on the allowed list. It’s a defense-in-depth control against a certificate being mistakenly or maliciously issued by an unintended CA, and it costs nothing to add beyond a single DNS record. The property tags a CAA record can carry, such as issue, issuewild and iodef, are registered as part of the Certification Authority Restriction Properties sub-registry inside IANA’s DNS Parameters registry.
CAA is one of several DNS-published controls for certificate security: DNSSEC protects the DNS data itself from tampering, while the newer SVCB/HTTPS record can publish TLS connection parameters directly in DNS.
CAA record is part of AdminKit’s DNS cluster; the full AdminKit glossary lists other related terms.
Frequently asked questions
What happens if a domain has no CAA record?
Any publicly trusted certificate authority can issue a certificate for the domain, as long as it passes that CA's own validation process.
Are certificate authorities required to check a domain's CAA record?
Yes -- the CA/Browser Forum's baseline requirements require CAs to check a domain's CAA record and refuse to issue a certificate if they aren't on the list of authorities it allows.
Does adding a CAA record require special infrastructure?
No -- it's a defense-in-depth control that costs nothing beyond adding a single DNS record.
What problem is a CAA record actually defending against?
A certificate for your domain being mistakenly or maliciously issued by a certificate authority you never intended to use.