In this guide · 7 sections
Short answer
A CAA record is a DNS record that tells certificate authorities which of them may issue SSL certificates for your domain, for example 0 issue "letsencrypt.org". With no CAA record, any public CA may issue. Before adding one, list every CA your website, CDN and email services use, or renewals will fail.
What a CAA record does
CAA stands for Certification Authority Authorization. Let's Encrypt's CAA documentation explains the default: every public CA is allowed to issue certificates for any domain name in public DNS, provided it validates control of the domain. A CAA record changes that default by listing the CAs you allow.
The standard is RFC 8659, published in 2019, which replaced the original 2013 version. Before issuing, a CA looks up your CAA record; if one exists and does not name that CA, the CA must refuse.
- What it protects against: a certificate for your domain being issued by a CA you never use, for example after someone briefly takes over a DNS record or a web page used for validation.
- What it does not do: it does not encrypt anything, affect certificates already issued, or stop someone who can change your DNS records (they could change the CAA record too).
That last point is why CAA belongs alongside, not instead of, strong security on your domain registrar and DNS accounts. Our best domain registrar guide covers registrar locks and MFA.
How a CAA record is written
Every CAA record has three parts: flags, tag and value. Let's Encrypt describes them as follows:
| Part | Common values | Meaning |
|---|---|---|
| Flags | 0 (or 128) | Almost always 0. 128 sets the critical bit: a CA that does not understand the tag must not issue. |
| Tag: issue | A CA's domain, e.g. letsencrypt.org | This CA may issue normal and, unless issuewild exists, wildcard certificates |
| Tag: issuewild | A CA's domain | Controls wildcard certificates (*.example.com) separately |
| Tag: iodef | mailto: or https: address | Where a CA may report a request that broke your policy |
| Value parameters | validationmethods, accounturi | Let's Encrypt supports limiting validation methods or a specific ACME account |
Multiple issue records are additive: if any one allows a CA, it may issue. Let's Encrypt's simple example is:
example.org CAA 0 issue "letsencrypt.org"
That one line allows only Let's Encrypt to issue for example.org and every subdomain, including wildcards, because there is no separate issuewild record.
Example CAA records for common set-ups
The value you need is each CA's own identifier, not the name of your host. Cloudflare's CAA records page shows the records it adds for the CAs it uses:
| Certificate authority | CAA value | Used by (examples) |
|---|---|---|
| Let's Encrypt | 0 issue "letsencrypt.org" | Many web hosts and Cloudflare |
| Google Trust Services | 0 issue "pki.goog" | Cloudflare and Google services |
| Sectigo | 0 issue "sectigo.com" | Cloudflare and paid SSL certificates |
| SSL.com | 0 issue "ssl.com" | Cloudflare and paid SSL |
The breakage risk: how CAA records stop renewals
CAA mistakes do not show immediately. The current certificate keeps working until it expires; the next renewal then fails and the site shows a security warning. The usual causes:
Before adding a CAA record, check
Let's Encrypt notes that the CA uses the CAA record closest to the name being certified, checking www.community.example.org, then community.example.org, then example.org. That lets you allow a different CA for one subdomain, for example an API hosted on a cloud provider, by adding a CAA record on that subdomain only. Our DNS records explained guide covers CNAMEs and the other record types.
How to check and add a CAA record
Work through this in order. It takes about 30 minutes for a typical small business domain.
Look up your current CAA records
Run dig example.com CAA +short (or use an online DNS lookup tool). Empty output means no CAA record: every public CA may issue.
List every service that serves HTTPS on your domain
Website host, CDN, online store, booking page, help centre, email security tools. Check each subdomain's CNAME target too.
Find which CA each one uses
Click the padlock on each site and view the certificate issuer, or read the provider's documentation.
Add one issue record per CA
At your DNS provider, add CAA records on the root domain with tag issue and each CA's identifier. Add an iodef address if you want violation reports.
Check renewals over the next 90 days
Automatic certificates renew every few months or more often. Confirm each site renewed successfully after the change.
Do it yourself or get help?
If your domain serves one website from one host, adding a CAA record is a five-minute DNS change once you know the CA. It gets riskier when several platforms share the domain, because one missed CA only shows up weeks later as a failed renewal.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Domain & DNS Setup (S$99) sets up DNS records for your website and email, checks SSL and HTTPS, sets www redirects and renewals. Our Website Security Hardening (S$290) covers updates, admin login protection with 2FA, a web application firewall, security headers with HTTPS enforced, and off-site backup. Ask in your brief if you want CAA records added and checked as part of either job.
Frequently asked questions
It is optional. Without a CAA record, any public certificate authority can issue a certificate for your domain once it validates control. A CAA record limits issuance to the CAs you name, which reduces the risk of mis-issued certificates. Only add one once you know every CA your services use.
Let's Encrypt's identifier is letsencrypt.org, so a record such as example.com CAA 0 issue letsencrypt.org, with the value in quotes, allows it to issue for the domain and its subdomains. Add separate issue records for any other CAs your host, CDN or platforms use.
No. A CAA record is only checked when a certificate is issued or renewed, so certificates already issued keep working until they expire. The risk is the next renewal: if the CA your host uses is not allowed, renewal fails and visitors see a security warning when the old certificate expires.
Not usually. Cloudflare says that if you use Universal SSL and add any CAA record, it automatically adds CAA records for the CAs it uses, such as Let's Encrypt and Google Trust Services. You need your own CAA records mainly if you upload custom certificates from another CA.
Run dig followed by your domain, the word CAA and +short in a terminal, or use an online DNS lookup tool and choose the CAA record type. No result means there is no CAA record. Cloudflare notes its automatically added records only show in such a lookup, not in the dashboard.