DNSprobe Wiki · CAA section
CAA records and certificate authority authorization
CAA records let a domain owner publish which certificate authorities are allowed to issue SSL/TLS certificates for the domain.
CAA stands for Certification Authority Authorization. It is a DNS record type used by certificate authorities before issuing a public certificate.
If no CAA record exists, public certificate authorities are not restricted by CAA. If CAA records exist, compliant authorities must respect them before issuing a certificate.
CAA is not required for every domain, but it is useful when you want tighter control over certificate issuance and clearer monitoring of unexpected certificate requests.
1. What CAA does
CAA records do not encrypt traffic and do not replace SSL certificates. They act as a policy signal in DNS, telling certificate authorities which issuers are allowed.
For example, a domain can authorize only Let’s Encrypt, DigiCert, Google Trust Services or another specific CA. Unauthorized CAs should refuse issuance.
CAA records are inherited from parent labels when no record exists on the exact name, so a policy at example.com can also affect www.example.com.
3. How DNSprobe checks CAA
DNSprobe queries CAA records for the tested domain and lists the host, TTL, flags, tag and value.
When an SSL certificate is available, DNSprobe also reads the current certificate issuer and compares it with the published issue records when possible.
If the current issuer does not appear to match the authorized CAs, DNSprobe shows a warning so you can verify the policy before the next certificate renewal.
4. Example CAA configuration
This example authorizes Let’s Encrypt for normal certificates, blocks wildcard certificates and provides a reporting address.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"The exact CA domain depends on your certificate provider. Always use the value documented by your CA.
5. Best practices
- Publish CAA records only after confirming which CA issues your current and future certificates.
- Include every CA that may legitimately issue certificates for the domain, including CDN or hosting providers if they manage SSL for you.
- Use issuewild deliberately: either authorize wildcard issuance or block it explicitly if you do not use wildcard certificates.
- Review CAA before changing CDN, hosting provider, ACME account or certificate authority.
6. Manual checks
You can inspect CAA records manually with standard DNS tools.
dig example.com CAAnslookup -type=CAA example.comSome DNS providers do not expose CAA in older control panels. If the command returns nothing, the domain may simply have no CAA records.