What is a CAA record
A CAA (Certification Authority Authorization) record is a type of DNS record that specifies which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. Continue reading to know what a CAA record is, how it works, and when you may need to add one to your domain’s DNS settings.
What is a CAA record
A CAA record is a DNS record that lets you control which Certificate Authorities can issue SSL/TLS certificates for your domain. For example, if your domain has a CAA record that authorises letsencrypt.org, other Certificate Authorities should not issue a certificate for that domain. CAA records can help reduce the risk of an unauthorised Certificate Authority issuing a certificate for your domain.
How does a CAA record work
When a Certificate Authority receives a request to issue a certificate for your domain, it checks the domain's CAA records. The record specifies the Certificate Authority that is authorised to issue certificates. If a CAA record exists and does not authorise the Certificate Authority, the CA should not issue the certificate.
CAA record elements
A CAA record typically contains the following information:
| DNS field | Description |
|---|---|
|
Domain Name/Name |
The domain or hostname the CAA record applies to. |
|
Record type |
|
|
Tag |
Defines what the record allows, such as |
|
Flag |
This indicates whether the record is critical or not and is represented by an integer between 0-255, with zero being the least critical flag. |
|
Hostname/Value |
Identifies the Certificate Authority that is authorised to issue the certificate for the domain. |
Read the Manage DNS records in Account Manager guide to learn how to add a CAA record.
Do you need a CAA record
You generally do not need to add a CAA record unless you want to restrict which Certificate Authorities can issue certificates for your domain. If no CAA record exists, Certificate Authorities are generally not restricted by CAA. However, they must still complete their required domain validation and other certificate issuance checks.
If you already have CAA records, make sure they authorise the Certificate Authority that you use for your SSL/TLS certificate. Otherwise, certificate issuance or renewal may fail.
Before adding a CAA record
Before creating a CAA record, check which Certificate Authority is issuing your SSL/TLS certificate. You should also check whether CAA records already exist for your domain to avoid unintentionally preventing certificate issuance.