CAA record generator

A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are allowed to issue TLS certificates for your domain. Since 2017, all public CAs must check CAA before issuing. If a CA is not listed, it must refuse, which protects you against certificates being issued by a CA you never chose.

How to use the generator

1. Enter your domain.
2. Add the CAs you use, for example letsencrypt.org, digicert.com or pki.goog.
3. Choose whether wildcard certificates are allowed and add an iodef contact for violation reports.
4. Copy the records into your DNS provider.

Example records

example.com. CAA 0 issue 'letsencrypt.org'
example.com. CAA 0 issuewild ';'
example.com. CAA 0 iodef 'mailto:[email protected]'

(In zone files the values are written in double quotes.) These records allow only Let's Encrypt to issue normal certificates, forbid wildcard certificates from any CA, and tell CAs where to report refused requests.

Record format

• Flag: usually 0. A flag of 128 marks the tag as critical.
• issue: CAs allowed to issue certificates for the name.
• issuewild: CAs allowed to issue wildcard certificates. If absent, issue applies to wildcards too.
• iodef: email or URL for incident reports.

Tips

• CAA records are inherited by subdomains unless the subdomain has its own CAA records.
• Add every CA you use, including those used by your CDN or hosting provider, before publishing, or certificate renewals will fail.