How to setup CAA record

Record Format

A CAA record consists of three parts: a flag, a tag, and a value.

CAA <flags> <tag> <value>

In practice, the flag is almost always set to 0. The tag defines what the record controls:

• issue — authorizes a CA to issue standard certificates for the domain or subdomain.
• issuewild — authorizes a CA to issue Wildcard certificates for the domain and its subdomains.
• issuemail — authorizes a CA to issue S/MIME certificates for email addresses on the domain.
• iodef — specifies an email address or URL the CA should notify if it receives an unauthorized certificate request for the domain.

The value is the CA's domain name, written in quotes:

                                    example.tld.  CAA 0 issue "sectigo.com"
                                example.tld.  CAA 0 issuewild "digicert.com"
                                example.tld.  CAA 0 issuemail "sectigo.com"
                                example.tld.  CAA 0 iodef "mailto:abuse@example.com"
                                

To block all CAs from issuing for a domain or subdomain, use a semicolon in place of the CA's domain name:

                                    example.tld.  CAA 0 issue ";"
                                

Key Behaviors

• A CAA record applies to all subdomains automatically, unless a subdomain has its own CAA record that overrides it.
• To authorize more than one CA for the same domain, add a separate CAA record for each.
• If no CAA record exists for a domain, any CA may issue a certificate by default.
• The full specification is documented in RFC 8659.

How to Check Your CAA Record

You can check the current CAA record for a domain using the command line:

dig example.tld caa

Or use an online tool such as the Google Admin Toolbox Dig utility

MPIC and DNSSEC

CAA checks are part of a broader set of domain validation safeguards. MPIC (Multi-Perspective Issuance Corroboration) requires CAs to validate domain control from multiple independent network locations before issuing a certificate. Learn more: Multi-Perspective Issuance Corroboration (MPIC).

DNSSEC adds cryptographic signing to DNS records, including CAA, protecting against DNS spoofing during validation. Learn more: DNSSEC Becoming Mandatory.