A SaaS vendor discovers a valid TLS certificate for app.example.com issued by an authority they never contacted. The site works, the padlock is green, no alert fired. Digging deeper, the team finds a DNS validation that passed three weeks earlier—likely after a registrar or DNS provider account compromise. With no CAA record, nothing forbade that issuance.
CAA (Certification Authority Authorization) is a small, often-forgotten DNS record that answers one simple question: who is allowed to sign a certificate for this name?
What CAA allows—and what it does not
A CAA record does not encrypt traffic and does not replace HTTPS. It tells certificate authorities (CAs) which entities may issue certificates for your domain. Since 2017, CA/B Forum members must check CAA before signing—except in very limited cases.
| CAA tag | Effect | Example |
|---|---|---|
issue | Allows a CA for standard certificates | 0 issue "letsencrypt.org" |
issuewild | Allows a CA for wildcards (*.domain) | 0 issuewild "digicert.com" |
iodef | Notification address for non-compliant requests | 0 iodef "mailto:secu@example.com" |
CAA does not protect against a CA that ignores the rule (rare but historically documented). It also does not stop an attacker who already controls your web server or private key. It mainly closes the quietest door: fraudulent issuance via DNS or HTTP validation.
Without CAA, any recognized CA can attempt to validate your domain. With CAA, you shrink the surface to the whitelist you define.
When CAA becomes essential
Three situations make it a priority:
Automatic renewal. Let's Encrypt, ZeroSSL, or internal ACME: if you restrict CAs without including yours, renewal breaks at midnight on a Sunday.
Multiple providers. CDN, host, load balancer—each may offer its own certificate. CAA forces an explicit decision instead of opportunistic issuance.
High-visibility domains. E-commerce, authentication, public APIs: a parallel certificate enables interception without touching your main infrastructure.
Concrete syntax for your stack
Minimal example for Let's Encrypt only:
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issuewild "letsencrypt.org"
If you use Cloudflare for TLS and Let's Encrypt at origin:
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issue "digicert.com"
Cloudflare uses DigiCert for edge certificates; Let's Encrypt remains common at the server. Omitting either causes hard-to-diagnose renewal failures.
| Scenario | CAs to allow | Common trap |
|---|---|---|
| VPS + Certbot | letsencrypt.org | Forgetting issuewild when a *.domain exists |
| Orange-cloud CDN | CDN CA + origin CA | Listing only Let's Encrypt |
| Enterprise EV cert | Your contracted CA only | Accidentally blocking internal staging |
Mistakes that break production on a Friday night
Overly strict CAA before migration. Changing CA? Update CAA before starting the new issuance, not after.
Long TTL + propagation. A wrong CAA can take hours to fix depending on TTL. Lower it temporarily during changes.
Subdomain with empty CAA. An empty CAA (;) on a subdomain forbids all issuance for that subdomain—useful for security, fatal if accidental.
Confusion with SPF/DKIM. CAA concerns X.509 certificates only, not email.
The climax: a green padlock does not prove it is your certificate
This is what "HTTPS enabled" checklists skip: TLS presence does not guarantee a single signer. Monitor Certificate Transparency logs and combine CAA with alerts on unexpected issuance.
Decide and move forward without blind spots
- Inventory who issues your certificates today (origin, CDN, staging).
- Publish matching CAA records, including
issuewildif needed. - Test ACME renewal in dry-run before locking down.
- Add an
iodefaddress to your security team or a monitored alias. - Document the CA change procedure in your runbook.
To compare hosts that integrate ACME or managed certificates, see our directory and comparator. The DNSSEC guide complements this if you are hardening the full DNS chain.
Frequently asked questions
What exactly is a CAA record?
A DNS CAA record lists which certificate authorities may issue certificates for a domain or wildcard. Reputable CAs check it before signing.
Does CAA replace automatic Let's Encrypt renewal?
No. It frames it. If you use Let's Encrypt, add letsencrypt.org to your CAA records—or renewal will fail at the next expiry.
Do I need CAA on every subdomain?
No. Resolvers walk the DNS tree—a CAA on example.com applies to subdomains unless a more specific CAA exists on the subdomain itself.
How do I verify CAA is active?
Query DNS with dig CAA example.com or an online tool, then attempt a test issuance from a non-listed CA—it should refuse.
The next time someone says "the site is on HTTPS, we're good," also ask: who is allowed to sign for this domain?