August 2, 2026•By Robert Miller, Chief Security Officer

CAA Records: Restricting Unauthorized SSL/TLS Certificate Issuance

What is a CAA Record?

DNS Certification Authority Authorization (CAA) is a DNS TXT-like security record (type 257) that allows a domain owner to specify which Certificate Authorities (CAs)—such as Let's Encrypt, DigiCert, or Sectigo—are authorized to issue digital certificates for their domain.

Why CAA Records are Essential

Before issuing an SSL/TLS certificate, public CAs are mandated by the CA/Browser Forum to check the domain's DNS for CAA records. If a CAA record exists and does not explicitly list the requesting CA, the CA must refuse to issue the certificate.

Common CAA Record Tag Syntax

issue "ca-name.com": Authorizes a specific CA to issue single-domain and multi-domain certificates.

issuewild "ca-name.com": Explicitly controls which CA can issue wildcard certificates (`*.yourdomain.com`).

iodef "mailto:security@yourdomain.com": Instructs CAs to send incident reports if an unauthorized certificate request is attempted.

Example DNS Configuration

```text

example.com. IN CAA 0 issue "letsencrypt.org"

example.com. IN CAA 0 issuewild "digicert.com"

example.com. IN CAA 0 iodef "mailto:security@example.com"

```