A CAA lookup shows which certificate authorities are allowed to issue TLS certificates for a domain - and which ones are explicitly forbidden.
What a CAA record actually does
Certification Authority Authorization (CAA) is a DNS record type defined in RFC 8659. It lets a domain owner publish a policy naming the certificate authorities permitted to issue certificates for that domain. Any CA that supports the CA/Browser Forum baseline requirements must check for a CAA record before issuing, and must refuse to issue if the requesting CA is not listed.
This flips the trust model. Without a CAA record, any of the few hundred publicly trusted CAs can issue a valid certificate for a domain, and the domain owner only finds out through certificate transparency logs after the fact. A CAA record turns that into an enforced allow-list, checked at issuance time rather than discovered afterward.
- CAA is not merely advisory: compliant CAs are contractually required to honor it
- A missing CAA record is not an error - it means any CA may issue
- CAA only restricts issuance; it has no effect on certificates already issued
The three property tags: issue, issuewild, iodef
A CAA record has three parts: a flag, a tag, and a value. The flag is 0 for informational or 128 for critical (a critical flag tells CAs unable to process the tag to refuse issuance rather than ignore it - in practice almost every record uses 0). The tag is one of three values.
| Tag | Controls | Example value |
|---|---|---|
| issue | Non-wildcard certificates for the domain and its subdomains | "letsencrypt.org" |
| issuewild | Wildcard certificates only (overrides issue for wildcards) | "digicert.com" |
| iodef | Where a CA sends a report on a disallowed issuance attempt | "mailto:security@example.com" |
Worked example
A domain that wants only Let's Encrypt to issue standard certificates, only DigiCert to issue wildcards, and to be notified of any policy violation would publish three CAA records at its apex:
- example.com. CAA 0 issue "letsencrypt.org"
- example.com. CAA 0 issuewild "digicert.com"
- example.com. CAA 0 iodef "mailto:security@example.com"
Reading the lookup output
The tool queries the CAA record type directly and lists one row per record found, each showing the record name (the domain queried) and a value string combining the flag and the tag value - for example "0 letsencrypt.org" for a non-critical issue record, or "128 sectigo.com" if the critical flag is set. If the domain publishes no CAA record at all, the result is empty: that is a valid, if permissive, state, not a lookup failure.
A record with an empty value after the flag (something like "0 ") usually reflects a CAA row where the CA field was left blank in the zone file, which most validators treat as invalid syntax - worth fixing at the registrar or DNS host rather than leaving in place.
Why CAA matters beyond compliance
CAA has been mandatory for CAs to check since September 2017 under the CA/Browser Forum baseline requirements, and RFC 8659 obsoleted the original RFC 6844 in 2019 to tighten the specification. For a domain owner, the practical benefit is narrowing the attack surface: if credentials at an unrelated registrar or a compromised reseller account are used to request a rogue certificate from a CA outside the allow-list, that request is rejected before a certificate is ever issued - no detection tooling required, no certificate transparency monitoring needed to catch it after the fact.
CAA does not replace certificate transparency monitoring or HSTS; it is a preventive control that sits earlier in the chain, at the point where a certificate would otherwise be minted.
FAQ
Does a missing CAA record mean my domain is misconfigured?
No. CAA is optional under RFC 8659. A domain with no CAA record simply allows any publicly trusted CA to issue for it, which was the default behavior of the web before CAA existed. Adding one is a hardening step, not a requirement for a working certificate.
Can I authorize more than one certificate authority?
Yes. Publish multiple issue records, one per CA identifier, and a CA is authorized if any of them matches. There is no limit on the number of issue or issuewild tags on a domain.
What CA identifier do I put in the value?
The domain name the CA publishes for CAA matching - for example "letsencrypt.org", "digicert.com", "sectigo.com", or "pki.goog" for Google Trust Services. Each CA documents its exact identifier; using the wrong string means that CA will be blocked even though you intended to authorize it.
Does issuewild replace issue, or add to it?
It restricts wildcard certificates specifically. If a domain has issue authorizing CA-A but issuewild authorizing CA-B, CA-A can still issue non-wildcard certificates but cannot issue a wildcard - only CA-B can. Without any issuewild tag, the issue tags govern wildcards too.
Why did a certificate get issued for my domain despite my CAA record?
CAA is checked by the issuing CA before signing, not enforced by DNS itself. If the CAA record was added after issuance, an existing certificate remains valid until it expires or is revoked. Also check that the record sits on the exact hostname or an ancestor, since CAA lookup walks up the DNS tree from the requested name to the first ancestor that has a record.
Does CAA work with subdomains or only the root domain?
CAA applies per-hostname with inheritance. If sub.example.com has no CAA record, a CA checks example.com, then the next label up, until it finds one or reaches the top. A subdomain can also publish its own CAA record to override the parent for that name specifically.
Related tools
- See the certificate actually issued for the domain, including which CA signed it
- Run a full DNS query across all record types, not just CAA
- CAA restricts certificate issuance; DMARC restricts email spoofing - both are DNS-based allow-list controls
- Domain verification and SPF policies are also published as DNS records alongside CAA