Cybersecurity glossary
What is a CAA Record?
Learn what a DNS CAA record is, how it limits which certificate authorities may issue for your domain, how inheritance works, and how to deploy CAA safely.
Definition
A CAA (Certification Authority Authorization) record is a DNS resource record that declares which certificate authorities are permitted to issue TLS certificates for a domain, helping reduce unauthorized issuance.
Why CAA records exist
TLS certificates prove control of names, but many public CAs can issue for the same domain if validation succeeds. A CAA record narrows that set: only listed authorities should issue, which shrinks the blast radius of mis-issuance and forgotten automation accounts.
CAA is a DNS policy control, not a replacement for Certificate Transparency monitoring or registrar hardening.
What CAA expresses
issue
Permits a named CA to issue non-wildcard certificates for the domain name.
issuewild
Permits wildcard issuance (*.example.com) by a named CA when present.
iodef
Optional reporting URI for issuance-related notifications from CAs.
Empty / deny posture
Careful combinations can effectively deny issuance until you intentionally allow a CA.
How issuance checks use CAA
Request a certificate
An applicant asks a CA to issue for a domain or wildcard.
CA looks up CAA
Before issuing, the CA retrieves CAA for the name, walking parents if needed.
Compare policy to CA identity
If CAA exists, the CA proceeds only when its issuer domain is authorized.
Validate domain control
HTTP-01, DNS-01, or other approved methods still must succeed.
Issue or refuse
Unauthorized CAs must refuse; authorized CAs may issue after validation.
Monitor afterward
CT logs and alerts still catch unexpected certificates even with CAA in place.
Common deployment pitfalls
| Pitfall | Impact | Fix |
|---|---|---|
| Allowing only one CA while automation uses another | Renewals fail suddenly | Inventory every issuing CA before publishing CAA |
| Forgetting issuewild | Wildcard issuance blocked or unexpectedly allowed | Define issue and issuewild explicitly |
| CAA on apex only, conflicting child needs | Subdomains inherit unwanted policy | Publish closer CAA sets where needed |
| Unsigned CAA on hostile networks | Spoofed permissive answers during checks | Use DNSSEC and protect DNS control planes |
Practical CAA checklist
- List every CA used for production, staging, CDN, and email TLS certificates.
- Publish issue/issuewild values that match real automation, including backups.
- Add iodef reporting where your CA and process can act on notices.
- Test renewals in a non-production window after CAA changes.
- Combine CAA with Certificate Transparency monitoring for defense in depth.
- Protect DNS edit rights; attackers who can change CAA can authorize their CA.
- Review CAA after vendor or CDN migrations that change issuing CAs.
- Prefer DNSSEC-signed zones so CAA lookups are authenticatable.
The practical takeaway
A CAA record tells the public CA ecosystem which issuers may mint certificates for your names. It is a high-leverage DNS control that reduces unauthorized issuance risk when kept accurate.
Deploy CAA deliberately, keep it aligned with real certificate automation, and pair it with CT monitoring and DNS integrity protections. Policy that blocks your own renewals is almost as painful as policy that allows everyone.
Related security terms
Certificate Authority (CA)
Organizations that issue certificates and must respect CAA policy.
Certificate Transparency
Public logs that help detect unexpected certificate issuance.
DNSSEC (Domain Name System Security Extensions)
Protects CAA answers from tampering on the resolution path.
SSL/TLS
The protocols that rely on certificates CAA helps govern.
TXT Record
Another text-oriented DNS record used for different policy and verification needs.
Frequently asked questions
What is a CAA record in simple terms?
A CAA record lists which certificate authorities are allowed to issue certificates for your domain. CAs must check it before issuing.
Does CAA stop all rogue certificates?
It reduces risk from unauthorized issuance by non-listed CAs, but it does not replace account security, CT monitoring, or careful subdomain control.
What do issue and issuewild mean?
issue covers non-wildcard certificates. issuewild covers wildcard certificates. You can allow different CAs for each.
What happens if no CAA record exists?
Any CA may issue for the domain, subject to normal validation rules. Empty policy is the historical default.
Does CAA inherit from parent domains?
CAs tree-walk upward looking for CAA. A record on the parent can constrain children unless a closer CAA set exists.
Should CAA be signed with DNSSEC?
Yes when practical. Without integrity protection, attackers who can spoof DNS might present a permissive CAA view during issuance checks.
What is iodef used for?
iodef can publish a reporting endpoint where CAs may send notices about issuance requests or policy violations.
References
Explore authoritative guidance and frameworks related to caa record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.