CAA Records Explained: Which CAs May Issue for Your Domain

A CAA record is a DNS record that says which certificate authorities (CAs) may issue certificates for your domain. Every public CA must check it before issuing. If your CA isn't listed, it has to refuse, and you get an error like "CAA record prevents issuance".

What a CAA record looks like

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "digicert.com"
example.com.  CAA  0 issuewild ";"
example.com.  CAA  0 iodef "mailto:[email protected]"

This allows Let's Encrypt and DigiCert to issue normal certificates, allows no CA to issue wildcard certificates, and gives CAs an address to report refused requests to. The value is the CA's own issuer domain, which the CA publishes: for example letsencrypt.org, digicert.com, sectigo.com, pki.goog for Google Trust Services and amazon.com for AWS Certificate Manager.

The rules that trip people up

• No CAA record means any CA may issue. Adding your first record forbids every CA you didn't list.
• Records add up. Each issue record allows one more CA. To add a CA, add a record; don't replace the existing ones unless you mean to.
• Subdomains inherit. For shop.example.com, the CA looks for CAA records there first, then on example.com. The closest name that has any CAA records decides.
• Wildcards follow issuewild. If an issuewild record exists, it alone decides wildcard certificates, and issue no longer applies to them.
• issue ";" forbids every CA. A value that doesn't parse forbids issuance too.
• Platforms bring their own CA. A CDN, hosting platform or cloud service that issues certificates for you uses its CA, not yours. Check which one and add it.

How to fix "CAA record prevents issuance"

1. Look up the records: dig example.com CAA, then the same for the exact name on the certificate and each parent.
2. Find your CA's issuer domain in its documentation. Some CAs also ask for parameters, such as an account ID.
3. Add an issue record for it (and issuewild if you need a wildcard and that tag is present).
4. Wait for the DNS change to reach your DNS provider's servers, then request the certificate again.

A broken DNS setup can block issuance as well: if the CA can't get an answer to its CAA lookup, it may refuse to issue.

What CAA doesn't do

CAA is checked only at the moment a CA issues. It doesn't affect certificates that already exist, browsers don't check it, and it can't stop a CA that ignores it or makes a mistake. To catch a certificate you didn't ask for, watch the Certificate Transparency logs for your domains.

Check your setup

Scan your domain free to see the certificate you serve today and which CA issued it, so you know which CA your CAA records must allow.