Do You Need a CAA Record?
You don’t strictly need a CAA record — but you should have one. A CAA (Certification Authority Authorization) record is a DNS entry that names which Certificate Authorities are allowed to issue TLS certificates for your domain. Since 8 September 2017, every public CA is required to check it before issuing, so a CAA record is a cheap, effective guard against an unauthorised or mis-issued certificate.
What a CAA record does
Defined in RFC 8659 (which replaced RFC 6844), a CAA record lists the CAs permitted to issue for your name. If a CA that isn’t listed is asked to issue a certificate for you, it must refuse. With no CAA record, any public CA may issue — which is the default, and why adding one narrows your attack surface.
Why it’s effectively mandatory to honour
The CA/Browser Forum passed Ballot 187, making CAA checking mandatory for all public CAs, effective 8 September 2017 (CA/Browser Forum — Ballot 187). So while you aren’t forced to publish one, the mechanism is universally enforced at issuance time — meaning a CAA record you publish will actually be obeyed by every compliant CA.
Do you need one?
Add a CAA record if:
- You want to limit mis-issuance — if an attacker tricks a different CA into issuing for your domain, CAA blocks it.
- You have a compliance or security posture that expects issuance controls.
- You use one or two CAs and want to pin them.
You can skip it only if you’re comfortable with any CA being able to issue for your domain. For almost everyone, the small effort is worth it — which is why our DNS check flags a missing CAA record as an advisory warning.
How to set one up
Publish a CAA record at your domain naming your CA(s). For example, to allow only Let’s Encrypt:
example.com. IN CAA 0 issue "letsencrypt.org"Common tags:
issue— the CA allowed to issue standard certificates.issuewild— the CA allowed to issue wildcard certificates.iodef— a contact (mailto/URL) for reports of policy violations.
Add an issue entry for every CA you use (including your CDN’s, if it issues on your behalf) — a too-strict CAA record can block a renewal.
Check it
See your CAA record (and A/AAAA/MX/NS/TXT) in one snapshot with the domain health check, or watch it for changes with DNS monitoring so a removed or altered CAA record doesn’t slip past you.
Sources
- RFC 8659 — DNS Certification Authority Authorization (CAA) Resource Record: https://datatracker.ietf.org/doc/html/rfc8659
- CA/Browser Forum — Ballot 187: Make CAA Checking Mandatory (effective 8 Sep 2017): https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/