What Is a CAA Record

A CAA (Certification Authority Authorization) record specifies which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for your domain. CAA records are a security measure that helps prevent unauthorized certificate issuance.

How CAA Records Work

When a CA receives a certificate request, it must check for CAA records:

example.com.    3600    CAA    0 issue "letsencrypt.org"

This tells CAs: "Only Let's Encrypt may issue certificates for example.com."

If no CAA records exist, any CA can issue certificates. Once you add CAA records, only authorized CAs can issue.

Record Components

Tags Explained

Common Use Cases

Allow Single CA (Let's Encrypt)

example.com.    3600    CAA    0 issue "letsencrypt.org"

Allow Multiple CAs

example.com.    3600    CAA    0 issue "letsencrypt.org"
example.com.    3600    CAA    0 issue "digicert.com"
example.com.    3600    CAA    0 issue "sectigo.com"

Separate Regular and Wildcard Issuance

; Regular certs from Let's Encrypt
example.com.    3600    CAA    0 issue "letsencrypt.org"
 
; Wildcard certs from DigiCert only
example.com.    3600    CAA    0 issuewild "digicert.com"

Deny All Certificate Issuance

example.com.    3600    CAA    0 issue ";"

With Violation Reporting

example.com.    3600    CAA    0 issue "letsencrypt.org"
example.com.    3600    CAA    0 iodef "mailto:security@example.com"
example.com.    3600    CAA    0 iodef "https://example.com/caa-report"

Allow Wildcard Only from Specific CA

example.com.    3600    CAA    0 issue "letsencrypt.org"
example.com.    3600    CAA    0 issuewild ";"  ; Deny all wildcards

Popular CA Identifiers

Record Format

Adding a CAA Record

Using the Dashboard

1. Navigate to your zone in the DNScale dashboard
2. Click Add Record
3. Configure the record:
   • Name: Usually @ for apex domain
   • Type: Select CAA
   • Flag: Choose 0 (Non-critical) or 128 (Critical)
   • Tag: Select issue, issuewild, or iodef
   • Value: Enter the CA domain or contact address
   • TTL: Set the cache duration (default: 3600)
4. Click Create Record

Using the API

Allow Let's Encrypt to issue certificates:

curl -X POST "https://api.dnscale.eu/v1/zones/{zone_id}/records" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "@",
    "type": "CAA",
    "content": "0 issue \"letsencrypt.org\"",
    "ttl": 3600
  }'

Add wildcard authorization:

curl -X POST "https://api.dnscale.eu/v1/zones/{zone_id}/records" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "@",
    "type": "CAA",
    "content": "0 issuewild \"letsencrypt.org\"",
    "ttl": 3600
  }'

Add violation reporting:

curl -X POST "https://api.dnscale.eu/v1/zones/{zone_id}/records" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "@",
    "type": "CAA",
    "content": "0 iodef \"mailto:security@example.com\"",
    "ttl": 3600
  }'

API Response:

{
  "status": "success",
  "data": {
    "message": "Record created successfully",
    "record": {
      "id": "encoded-record-id",
      "name": "example.com.",
      "type": "CAA",
      "content": "0 issue \"letsencrypt.org\"",
      "ttl": 3600,
      "disabled": false
    }
  }
}

CAA Inheritance

CAA records are inherited by subdomains unless overridden:

; Apex CAA - applies to example.com and all subdomains
example.com.         3600    CAA    0 issue "letsencrypt.org"
 
; Override for specific subdomain
shop.example.com.    3600    CAA    0 issue "digicert.com"

In this case:

• example.com - Let's Encrypt only
• www.example.com - Let's Encrypt only (inherited)
• shop.example.com - DigiCert only (overridden)

Best Practices

1. Start with monitoring - Add iodef records to receive reports before restricting issuance

2. Include your actual CA - Before adding restrictive records, verify which CA you use

3. Plan for wildcards - Remember issuewild is separate from issue

4. Use non-critical flag (0) - Only use flag 128 if you want strict enforcement

5. Update before changing CAs - Add new CA authorization before switching providers

6. Don't forget subdomains - Check if subdomains need different policies

Troubleshooting Certificate Issuance

If certificate issuance fails after adding CAA records:

1. Verify CAA records exist:

   dig CAA example.com

2. Check for correct CA identifier:

   • Contact your CA for exact identifier
   • Some CAs use parent company identifiers

3. Verify wildcard authorization:

   • issuewild is required for wildcard certificates
   • If only issue exists, wildcards will fail

4. Check subdomain inheritance:

   • Subdomains inherit parent CAA unless overridden

Testing CAA Records

# Query CAA records
dig CAA example.com
 
# Check with specific nameserver
dig CAA example.com @ns1.dnscale.eu
 
# Use online tools
# - SSLLabs SSL Test
# - CAA Test (caatest.co.uk)

Related Record Types

• TXT - Domain verification for CAs
• TLSA - DANE certificate pinning
• A - Server address for validation

Conclusion

CAA records are a simple but effective security measure for controlling SSL/TLS certificate issuance. By specifying which CAs can issue certificates for your domain, you reduce the risk of unauthorized certificate creation. DNScale makes it easy to configure CAA records with intuitive tag selection for issue, issuewild, and iodef policies.