CAA records explained: limit who can issue your SSL certificates

Any public certificate authority can, in principle, issue a certificate for any domain, as long as it validates that the requester controls it. A CAA (Certification Authority Authorization) record narrows that down: it tells CAs which of them are allowed to issue for the domain. Since September 2017, public CAs have been required to check it. The current standard is RFC 8659.

What a CAA record looks like

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "pki.goog"
example.com.  CAA  0 issuewild ";"
example.com.  CAA  0 iodef "mailto:security@example.com"

• issue: a CA allowed to issue certificates. One record per CA.
• issuewild: CAs allowed to issue wildcard certificates. ";" means none. If absent, issue applies to wildcards too.
• iodef: where CAs may report a refused request. Not all CAs use it.
• The leading 0 is the flags field; leave it at 0.

Common CA identifiers

Check the CA's own documentation for the exact value: some brands share an identifier, and some resellers issue through a different CA than their name suggests.

Adding one without breaking renewals

1. Find who issues today. Look at the current certificate's issuer in the browser, in public certificate transparency logs, or in a Hookgap report's SSL card. Do this for every subdomain with its own certificate.
2. Check the hosting platform. Managed hosts, CDNs and website builders may use more than one CA and switch between them. Some, including Cloudflare for its Universal SSL certificates, add the CAA entries they need automatically when you create CAA records. Read their documentation first.
3. Add an issue record for each CA in use, plus issuewild if you want to restrict wildcards.
4. Note it in the client's documentation, so whoever changes hosting next knows to update it.

How CAs find the record

A CA issuing for shop.example.com looks for CAA at shop.example.com first. If there is none, it climbs to example.com. The first set of CAA records found applies. So one record set on the main domain covers everything, and a subdomain that uses a different CA can have its own.

What CAA does and does not do

CAA reduces the risk of a mistaken or fraudulently obtained certificate from a CA the business has never used. It does not stop a listed CA from issuing, and it does not protect a site whose DNS or registrar account is compromised. It belongs on the domain security checklist as a quick, low-risk win, not as a cure-all. Hookgap reports domains without CAA as a low-priority gap.