DNS record types

What is a CAA record?

A CAA record names which certificate authorities are allowed to issue certificates for a domain.

Without a CAA record, any of the hundreds of trusted certificate authorities may issue a certificate for your domain. With one, authorities are required to check it and refuse if they are not listed.

It is a preventative control rather than a detective one: it stops a mis-issued certificate at the point of issue instead of finding it afterwards in Certificate Transparency logs.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

The mistake people make

Remember every issuer you actually use, including the one your CDN or load balancer provisions certificates through. A CAA record that omits your CDN's authority breaks certificate renewal quietly, weeks later, when the existing certificate expires.

Check the CAA records on a real domain, with everything else that can quietly break.

Check a domain