CAA records setup

What CAA does

A CAA (Certificate Authority Authorization) record is a DNS record that tells certificate authorities: only authorities listed here may issue certificates for this domain. The record is checked when someone requests a certificate, and again at renewal, against the DNS at the parent of the name being issued. If DNS has no CAA record, any CA may issue. Add one, and issuance is narrowed to the authority you named.

It is a leash, not a lock. A CA that issues despite your CAA has broken the spec, not your zone. The real value is control: no CA can surprise you with a cert for your domain, and a renewal failure after a config change is traced to a CAA edit you can see in the zone.

What the record looks like

CAA uses three tags, out of which two matter for normal use:

The flags field is a small integer, 0 for portable, non-critical tags. The quoted string is the CA issuer domain.

DNS-level credence: CAA is not a substitute for confirming who actually issued a certificate. The responsible check on your side is:

1. Put a CAA record in place before any public certificate request, using the CA you intend to use.
2. For Let's Encrypt (the free certificate guide uses it), two records:

example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild "letsencrypt.org"

1. If you want a hard no-issue marker, 0 issue ";" says no authority may issue, and should be removed before you ever need a real cert. Be aware this blocks wildcard issuance too when no issuewild record exists.

How to add them

1. Follow the same route as any TXT or A record in your DNS zone (registrar or DNS host panel). CAA is a genuine DNS record type, not a TXT with the string "CAA" in it; pick the record type CAA.
2. Set owner example.com (apex), TTL 3600, flags 0, tag issue, value letsencrypt.org quoted.
3. Add the issuewild twin if you ever expect a wildcard (*.example.com).
4. If you use a vendor CDN or security layer, use the CAA values the vendor publishes, usually on a support page listing the CA they bound to.
5. Verify with a lookup tool after propagation, and again when a renewal silently fails: dig CAA example.com (where supported).

Gotchas

• Child names: a CAA record applies to the name in the query and its subdomains unless a deeper record overrides it. Keep the apex record tight and you cover the site.
• Multiple CAs: list both letsencrypt.org and your backup CA if you ever switch, or renewals (which are new issuance) will fail abruptly at edge time.
• Wildcard precedence: issuewild applies only to wildcard requests and overrides issue when at least one issuewild exists. With no issuewild, your issue records already cover wildcards too. Add issuewild only when you want different permissions for wildcard than non-wildcard issuance; otherwise a stray issuewild ";" blocks all wildcard issuance.

Renewal time is when CAA bites hardest: the renewal checklist flags the window, and the record types reference places CAA next to CNAME and TXT in the zone model.