Understanding CAA records

Why CAA records exist

Certificate authorities are required to check CAA records before issuing a certificate. If your domain publishes CAA records and the CA isn't listed, it must refuse. This reduces the risk of a certificate being wrongly issued for your domain.

What CAA records look like

example.co.za.  3600  IN  CAA  0 issue "letsencrypt.org"
example.co.za.  3600  IN  CAA  0 issue "sectigo.com"
example.co.za.  3600  IN  CAA  0 issuewild ";"
example.co.za.  3600  IN  CAA  0 iodef "mailto:security@example.co.za"

The tags

The leading number is a flags field; 0 is normal.

How CAA lookups work

If a name has no CAA record, the CA checks its parent, then the parent's parent, up to the root of your domain. If no CAA record is found anywhere, any CA may issue. So a CAA record on example.co.za also covers shop.example.co.za unless the subdomain has its own.

The classic CAA mistake

Adding CAA records for one CA, then moving to a host whose free certificates come from a different CA. Renewals silently fail and the site eventually shows certificate errors. Before changing host or CDN, check which CA they use and add it.

Common certificate authority values

Each CA publishes the exact value it checks for. Common ones include:

Your web host, CDN or SSL reseller may use more than one CA, and that can change. Always check their current documentation and include every CA they list.

Adding CAA records safely

1. Find out which CA issued your current certificate (click the padlock in your browser and view the certificate details).
2. Find out which CA(s) your host or CDN uses for renewals.
3. Add one issue record per CA, plus issuewild if you use wildcard certificates.
4. Optionally add an iodef address for violation reports.
5. Watch the next certificate renewal to confirm it succeeds.

Checking CAA records

Use the CAA lookup, or the All DNS Records lookup to see CAA alongside everything else.

dig example.co.za CAA +short