What Is a CAA Record and How Do You Set It Up?

A CAA record (Certification Authority Authorization) is a DNS record that names the certificate authorities (CAs) allowed to issue SSL/TLS certificates for your domain. Before issuing, every public CA must look up your CAA records; if they exist and do not list that CA, it has to refuse the order. This has been mandatory for public CAs since 8 September 2017 (CA/Browser Forum ballot 187), and the record format is defined in RFC 8659.

How does a CAA record work?

When you order a certificate, the CA checks the exact hostname for CAA records. If there are none, it moves up one level – from shop.example.com to example.com – and stops at the first level that has CAA records. Those records decide. A subdomain can therefore have its own policy that overrides the parent domain.

CAA is checked alongside domain validation, but it is a separate control: validation proves you own the domain, while CAA states which CAs you allow. For the full sequence of checks, see how SSL validation works.

What does a CAA record look like?

Each record has a flag (normally 0), a tag and a value. A typical setup allows two CAs and asks for violation reports by email:

example.com.  CAA 0 issue "digicert.com"
example.com.  CAA 0 issue "sectigo.com"
example.com.  CAA 0 iodef "mailto:[email protected]"

Each issue line adds one allowed CA. To forbid all issuance for a name, use 0 issue ";".

Which CAA value do you need for DigiCert or Sectigo?

You list the CA’s issuer domain, not the product or brand name. As of October 2026, DigiCert’s documentation names digicert.com and treats geotrust.com, thawte.com and rapidssl.com as equivalent; Sectigo’s documentation names sectigo.com. Check the CA’s current documentation before you change DNS, because issuer domains can change after mergers and rebrands.

Can a CAA record block your certificate order?

Yes. If your domain has CAA records and none of them names the issuing CA, the CA must stop the order – even though you own the domain and passed validation. A typical case: a renewal stalls because someone added CAA for a different provider, such as a CDN or a free certificate service.

Tip: Before you switch brands or CAs, add the new CA’s issue record next to the old one. Remove the old value only after the old certificates have been replaced.

Orders can also stall when the CA cannot get a clean DNS answer – for example a timeout at your DNS provider or a broken CNAME chain. Check the records with a DNS lookup tool before reissuing.

Do you need a CAA record for wildcards?

Not separately – but issuewild lets you set a different rule for them. Without any issuewild record, your issue records also apply to wildcard certificates. Once at least one issuewild record exists, CAs ignore the issue records for wildcard requests and follow only issuewild.

example.com.  CAA 0 issue "sectigo.com"
example.com.  CAA 0 issuewild "digicert.com"

Here Sectigo may issue normal certificates, but only DigiCert may issue wildcards. To ban wildcards entirely, use 0 issuewild ";".

Who should use CAA records?

Any domain owner can add CAA records, but they matter most where an unauthorized certificate would be costly. Banks, insurers and payment providers can use it to show auditors that only approved CAs may issue for their domains – see SSL for financial services. Large organizations with many teams and domains use CAA to keep issuance within approved CAs, typically as part of enterprise SSL management.