A CAA record (Certification Authority Authorization, RFC 8659) is a DNS record that names the certificate authorities permitted to issue certificates for a domain. Before issuing, a compliant CA must check the CAA record and refuse if it is not listed. This reduces the risk of an attacker, or an unintended CA, obtaining a valid certificate for your domain.
The record uses a flag, a tag and a value. The common tags are issue for standard certificates, issuewild for wildcard certificates, and iodef to supply a contact address for reporting attempted violations. For example, 0 issue "letsencrypt.org" allows only Let's Encrypt to issue. An empty value such as 0 issue ";" forbids all issuance.
CAA matters for email because mail security increasingly depends on TLS certificates, for MTA-STS policy hosts, for DANE, and for the web endpoints behind your brand. Limiting who can issue certificates narrows the surface for mis-issuance and impersonation.
CAA is checked at issuance time, not on every connection, so it complements rather than replaces certificate validation. Records can be set on the apex and inherited by subdomains. Check your CAA records to confirm only your intended authorities are authorised, and add an iodef address so you are notified of blocked attempts.
Check it on your domain
- CAA Checker: look up Certificate Authority Authorization records.
- DNS Record Checker: look up any DNS record type for a host.