CAA records: who may issue your certificates

Published September 9, 2026. Updated September 9, 2026.

A CAA (Certification Authority Authorization) record lists which certificate authorities (CAs) are allowed to issue TLS/SSL certificates for your domain. A CA is required to check it before issuing.

Why it matters

Without CAA, any public CA can issue a certificate for your domain, so a single mis-issuance or a tricked CA anywhere in the world can produce a valid-looking certificate for your site. A CAA record narrows that to the CAs you actually use, so the others must refuse. It is a small record with a real reduction in attack surface.

What the report checks

Whether a CAA record exists at your domain and lists at least one authorized issuer. CAA is optional, so its absence is informational, not an error, but publishing one is recommended.

How to fix it

Add CAA records at your domain (the apex) naming your CA. For example, a domain that uses Let's Encrypt:

example.com.  CAA 0 issue "letsencrypt.org"
example.com.  CAA 0 issuewild "letsencrypt.org"
example.com.  CAA 0 iodef "mailto:security@example.com"

issue authorizes normal certificates; issuewild authorizes wildcards; iodef is where a CA reports a blocked request.
List every CA you use (your host's, your CDN's, your own). If you use Cloudflare, Google, or a host that issues on your behalf, include theirs too, or issuance will fail.

How to verify

dig example.com CAA +short

You should see one line per authorized issuer. After adding one, request or renew a certificate and confirm it still issues.

Common mistakes

Listing only one CA when you use several. If your host, CDN, and your own Let's Encrypt setup all issue certificates, list them all, or issuance will start failing.
Blocking wildcards you rely on. issue does not authorise wildcard certificates; add issuewild if you use them.
Expecting CAA to secure an existing certificate. CAA only constrains new issuance; it does not revoke or validate certificates already issued.