CAA Record Guide: Control Who Can Issue Certificates

A CAA (Certification Authority Authorization) record is a DNS resource that lists which certificate authorities (CAs) are allowed to issue TLS certificates for your domain. CAs that respect CAA must refuse issuance when your policy does not name them. That does not replace expiry monitoring or grade checks — it reduces the chance of a surprise certificate from an unexpected CA.

This guide covers the tags teams actually publish, how wildcards differ, and where CAA sits next to a PatchPings SSL certificate checker and DNS health scan.

What CAA answers

Without CAA, any publicly trusted CA may issue for your domain if someone can prove control through ACME, email, or DNS challenges. With CAA, you publish an allow-list. Mis-issuance risk shrinks when attackers or mistaken automation pick a CA you never authorised.

Common CAA tags

• `issue` — which CA may issue certificates for the hostname (and typically non-wildcard names under that policy).
• `issuewild` — which CA may issue wildcard certificates. An empty issuewild can forbid wildcards even when issue allows a CA.
• `iodef` — where CAs may send reports about issuance requests or policy violations (often a mailto: URL).

example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issuewild ";"
example.com. CAA 0 iodef "mailto:security@example.com"

Inheritance and subdomains

CAA is evaluated by walking up the DNS tree until a set of CAA records is found. A subdomain without its own CAA inherits the parent policy. Publish deliberately at the apex you control, and override on subdomains only when a different CA or team owns that zone.

CAA vs SSL expiry monitoring

CAA answers "who may issue." SSL certificate expiry monitoring answers "will this cert die on a calendar date." You need both. A perfect CAA policy still fails visitors if the live leaf expires. Spot-check the live cert with the SSL certificate checker after DNS or ACME changes.

Rollout checklist

1. 1List every CA your automation and vendors actually use today.
2. 2Publish matching issue (and issuewild if you need wildcards).
3. 3Add iodef so policy violations have somewhere to land.
4. 4Renew or re-issue once under the new policy before you rely on it.
5. 5Re-check DNS after zone transfers or registrar moves.

CAA is a quiet DNS control that belongs next to TLS hygiene, not instead of it. Publish an allow-list that matches reality, keep expiry watches running, and treat unexpected CA names in CT or mail reports as incidents worth investigating.