CAA Record Lookup

What CAA records do

A CAA (Certification Authority Authorization) record lists the certificate authorities allowed to issue certificates for a domain. Since September 2017, publicly trusted CAs must check CAA before they issue, and refuse when the record does not name them. Three tags do most of the work: issue names a CA allowed to issue ordinary certificates, issuewild names a CA allowed to issue wildcard certificates, and iodef gives an address where CAs can report requests they refused. CAA limits who may issue; it does not change certificates that already exist.

How CAs find the CAA records that apply

A CA checking www.shop.example.com looks for CAA records at that exact name first. If there are none, it tries shop.example.com, then example.com, and uses the first set it finds (RFC 8659). So CAA at the domain covers every subdomain without records of its own, and a subdomain can override it with its own set. This lookup follows the same climb and tells you at which name the records it shows were found.

How to read the result

The facts summarise who may issue ordinary certificates, who may issue wildcards, and where violation reports go. The table lists every record with its flags and a plain-language meaning. No CAA records anywhere up the tree means any publicly trusted CA may issue. An issue record with an empty value (issue ";") forbids issuance altogether, which suits names that never need a certificate. A record with flag 128 is critical: a CA that does not understand its tag must refuse.

Common CAA problems

The classic one: CAA is added for the CA you buy certificates from, and the next automatic renewal of a certificate from another CA fails. CDNs, hosting platforms and managed load balancers often issue through their own CA; Cloudflare, for example, can use Let's Encrypt or Google Trust Services, and AWS Certificate Manager uses Amazon. Other problems are an issuewild ";" that blocks wildcard certificates nobody meant to block, a typo in the CA's domain name, and nameservers that time out on CAA queries, which makes CAs refuse to issue rather than guess.

Building a CAA policy

Start with an inventory of the certificates you actually have, for example by searching Certificate Transparency logs for your domain. Add an issue record for every CA that appears, including those your CDN or hosting provider uses. Add issuewild only if wildcards should follow different rules. Add an iodef address to hear about refused requests. RFC 8657 adds parameters to bind issuance to a specific ACME account or validation method, for tighter control. The CAA generator builds the records for you.

Primary sources

• RFC 8659: DNS Certification Authority Authorization (CAA)
• RFC 8657: CAA extensions for ACME account and method binding