Free tool · no signup

CAA record generator

Decide which certificate authorities may issue SSL certificates for your domain and get the exact DNS records to publish. A small step that shrinks the chance of a rogue certificate.

By the Bug Circuit security team · Last updated November 10, 2026

Zone-file lines

example.com. 3600 IN CAA 0 issue "letsencrypt.org"

BIND style (relative to the zone)

@ 3600 IN CAA 0 issue "letsencrypt.org"

For a DNS dashboard

Type	Flags	Tag	Value
CAA	0	issue	letsencrypt.org

CAA is checked only when a certificate is issued or renewed. Certificates you already have keep working, but a renewal from a CA that is not listed will fail, so list every CA you use, including the one your CDN or host uses.
Add a report address so a CA can tell you about a refused or suspicious request.
Add these at the apex of the domain. They also cover subdomains unless a subdomain has CAA records of its own. A DNS host that does not support the CAA type will show an error: ask them or move DNS.

What is a CAA record? A DNS record that lists the certificate authorities allowed to issue certificates for your domain. Every public CA must check it before issuing. Pick the CAs you use, copy the records into DNS, and an unlisted CA has to refuse the request.

How it works

What CAA does

A certificate authority (CA) issues the SSL certificates that give your site its padlock. Hundreds of CAs exist, and without a CAA record any of them can issue a certificate for your domain to whoever passes its checks. CAA (RFC 8659) lets you name the CAs you use. Since 2017 the CA/Browser Forum has required public CAs to look up your CAA records before they issue, and to refuse if they are not listed.

It is a safeguard, not a lock. It stops a mistaken or careless issuance by a CA you did not choose, and it narrows the attack surface if someone tricks a CA into issuing. It does not affect certificates that already exist, and it cannot stop a CA you listed from being fooled.

The records

An issue record names a CA that may issue normal certificates, for example 0 issue "letsencrypt.org". An issuewild record controls wildcard certificates (*.example.com), and when it exists it overrides issue for wildcards. An issue record with just ";" means no CA may issue. An iodef record gives an address where a CA can report a refused or suspicious request. The leading 0 is the flags field, and 0 is right for almost everyone.

A CAA lookup starts at the name being certified and climbs towards the root, so a record at the apex of example.com also covers www.example.com and other subdomains unless a subdomain has records of its own.

Do not lock yourself out

CAA is checked at issuance and at every renewal, so an unlisted CA that renews your certificate will now fail. List every CA that issues for you, including the one behind your CDN, your hosting panel or your email provider, because they often use a different CA from the one you bought from. If you use Cloudflare Universal SSL or a similar service, add the CAs listed in its documentation. After you publish, check the record with dig example.com CAA, then renew a certificate in a quiet moment to confirm it still works.

Worked examples

One CA, with a report address

Only Let's Encrypt, wildcard allowed from the same CA.

example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"

The simplest useful record. Any other CA must refuse a request for example.com or its subdomains.

Two CAs, no wildcards

Let's Encrypt and DigiCert, wildcard certificates not allowed.

example.com. 3600 IN CAA 0 issue "digicert.com"
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"

The issuewild record with ";" means no CA may issue a wildcard certificate.

A domain that must never have a certificate

A parked or brand-protection domain.

example.org. 3600 IN CAA 0 issue ";"

Remove the record before you ever need a certificate for this domain.

Frequently asked questions

Do I need a CAA record?

It is optional, but it is cheap and takes a minute. It reduces the chance of a certificate being issued for your domain by a CA you never chose, and some security scans and compliance checks look for it.

Will CAA break my existing certificates?

No. It is checked only when a certificate is issued or renewed. But a renewal from a CA that is not listed will fail, so list every CA you use, including the one behind your CDN or host.

What is the difference between issue and issuewild?

issue controls normal certificates, and issuewild controls wildcard certificates such as *.example.com. If an issuewild record exists, it decides for wildcards. If not, the issue records cover wildcards too.

What do the flags mean?

A flag of 128 marks a property as critical, meaning a CA that does not understand it must refuse to issue. Almost everyone uses 0, which is what this tool writes.

How do I check that my record is live?

Run dig example.com CAA, or use our DNS record lookup. You should see one line per record. Note that a CA also looks at the parent domain if the name itself has none.

Does CAA apply to subdomains?

Yes. A lookup climbs from the subdomain up to the root, so records at the apex apply everywhere unless a subdomain publishes its own CAA records, which then take over for that name.

My DNS host does not support CAA records. What now?

Ask them to add support, since the record type has been standard since 2013, or move DNS to a provider that has it. Do not skip it by adding the record as a TXT record, because CAs do not read that.

Keep reading

SSL Certificate CheckerExpiry, chain and protocol problems.DNS Record LookupSee the records you published.Security Headers GeneratorHSTS and more for your web server.Security checklist before launchWhat to check before going live.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing