CAA records: choosing who can issue your certificates

How CAA records choose which certificate authorities may issue for a domain, and how to keep one from blocking your next renewal.

A CAA record lists the certificate authorities allowed to issue certificates for your domain. Before issuing, an authority must check for CAA records (RFC 8659). If there are some and they don’t name it, it must refuse. That limits the damage if someone tricks another authority into issuing a certificate for your site.

CAA is optional, and it only affects new certificates. Changing it doesn’t touch certificates already issued, but it does decide whether they can be renewed.

What SignalDNS checks

The DNS check asks for the name’s CAA records and shows them with the other records. We don’t judge them on their own: having none is fine.

When the report has also checked the certificate, it compares the two. If the name has CAA records, the certificate is trusted, and its issuer is an authority we recognise, the records should allow that authority. We recognise Let’s Encrypt, Google Trust Services, DigiCert, Sectigo, Amazon, GlobalSign, SSL.com, Buypass, Entrust, and GoDaddy, by the names in their certificates.

We only read CAA records on the name itself. A subdomain without records of its own follows its parent’s, which we don’t ask for, so this check can’t flag those.

What a CAA record looks like

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:[email protected]"
  • 0 is the flags field. Leave it at 0.
  • issue names an authority that may issue certificates for this name. Add one record for each authority you use. issue ";" allows none.
  • issuewild does the same for wildcard certificates, such as *.example.com. When there’s no issuewild, wildcard certificates follow issue.
  • iodef gives an address where authorities may report requests that break your policy.

Each authority documents the value to use, such as letsencrypt.org for Let’s Encrypt, pki.goog for Google Trust Services, and amazontrust.com for Amazon.

Authorities look for CAA on the exact name first, then on each parent in turn, and use the first records they find. A record on example.com covers www.example.com, unless www has records of its own. They also follow aliases: if shop.example.com is a CNAME, the CAA records at its target apply.

There are no CAA records

With no CAA records on the name or any parent, any authority may issue certificates for it. That’s the default, it’s common, and nothing breaks, so SignalDNS doesn’t flag it.

Adding CAA is a small extra protection. If you add it, list every authority that issues certificates for you, including any your host or CDN uses on your behalf. Leaving one out means that service can’t renew.

If your site is on Cloudflare with Universal SSL, Cloudflare adds CAA records for the authorities it uses whenever you add any CAA records yourself. They appear in DNS lookups, but not in its dashboard.

CAA would block the next renewal

The certificate the site uses now was issued by an authority that the name’s CAA records don’t allow. The current certificate still works. But when it’s due for renewal, that authority must check CAA, find it isn’t listed, and refuse, and the site would be left with an expired certificate. SignalDNS adds this to “Is the connection secure?” as needing attention.

This is a cross-check between the DNS and certificate answers. It can happen when CAA records were added or changed after the certificate was issued, or when a host changed the authority it uses. For a wildcard certificate, we check issuewild records if there are any, and issue records otherwise.

How to fix it: add a record for the authority that issued the current certificate, and keep the records you already have. The report suggests one, such as:

example.com.  CAA  0 issue "letsencrypt.org"

Use issuewild instead if the certificate is a wildcard and you already have issuewild records. Or, if you meant to switch authorities, renew with one the records allow before the current certificate expires. See Certificate renewal.

Your provider’s guides

What we can’t tell from outside

We read CAA on the name itself, and compare it only with authorities we recognise by name. We don’t follow CAA up to parent domains, as authorities do. We can’t tell which authority your host will use next time, and some hosts use more than one. A record can also limit an authority to one account (RFC 8657); we compare only the authority’s domain, so a renewal from another account could still be refused.

Sources

Last reviewed .