What a CAA record is
A CAA (certification authority authorization) record names the certificate authorities that may issue certificates for a domain. Every public authority must look for it before issuing, and must refuse if it is not on the list.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"How to read the result
| Tag | Meaning |
|---|---|
issue | This authority may issue certificates for the name. |
issuewild | This authority may issue wildcard certificates (*.example.com). If absent, the issue list applies to wildcards too. |
iodef | Where an authority can report a request it refused. |
A value of ";" means "nobody". The number at the start is a flag, almost always 0.
No CAA record at all means any authority may issue. That is the default and it is not an error. If a subdomain has no CAA record, the authority checks the parent domain and uses the first record it finds on the way up.
Common CAA mistakes
- Renewal fails after adding CAA. The record lists one authority and your host or CDN uses another. List every authority that issues for you, including the one your CDN uses.
- Wildcards blocked by accident. An
issuewild ";"line forbids all wildcard certificates. - A wrong authority name. Each authority publishes the exact value to use, for example
letsencrypt.orgorpki.goog. A typo blocks issuing.