Generators

CAA Record Generator

CAA Records

Build CAA records

Choose the certificate authorities allowed to issue certificates for your domain, then generate ready-to-publish CAA records.
Optionsbuild one or more CAA records, then publish them at your DNS provider
Domain name
Authorized CAs
CAIssueWildDisallowTTL
letsencrypt.org
Violation reports (iodef)

Tool features

Take control of certificate issuance for your domain with CAA records
4 features

Control Issuance

Restrict which CAs may issue certificates for your domain

Popular CAs Built In

Pick from Let's Encrypt, DigiCert, Sectigo, Google and more

Per-CA Tags

Toggle issue, issuewild, or disallow with custom TTLs

Violation Reports

Add an iodef contact so CAs report policy violations

What is a CAA record & how it works

How DNS decides which CAs may issue for your domain

A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities may issue certificates for your domain. Every public CA must check CAA before issuing, and must refuse if it is not on the list.

CAA records are inherited: a record on example.com also covers www.example.com and every other subdomain unless that subdomain publishes its own. The issue tag controls normal certificates, issuewild controls wildcards, and iodef tells CAs where to report blocked requests.

issue
CAs allowed to issue any certificate, e.g. 0 issue "letsencrypt.org".
issuewild
CAs allowed to issue wildcard certificates; overrides issue for wildcards.
iodef
A mailto: or https: URL where CAs can report issuance attempts that violate policy.

How to use this tool

Build a CAA policy in four steps
1
Enter your domain
Type the domain the policy should apply to; subdomains inherit it.
2
Choose the CAs
Tick every CA you use, including those behind your CDN, host or load balancer.
3
Set wildcard and reporting
Decide who may issue wildcards, or disallow them, and add an iodef contact if you want violation reports.
4
Publish and verify
Add the generated records at your DNS provider, then confirm them with the CAA Lookup tool.

Related tools

Keep debugging with tools from the same suite
4 tools
CAA Lookup
Check Certificate Authority Authorization (CAA) records for SSL certificate issuance control
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail
DNS Lookup
Perform DNS queries for A, AAAA, MX, TXT, CNAME, and other DNS record types

Frequently asked questions

Common questions about CAA records
5 Q&A

Any publicly trusted CA may issue certificates for the domain. Adding CAA narrows that to the CAs you list, which limits the damage from a mis-issuance or a compromised account at another CA.

No. CAs only check CAA at issuance time, so certificates already issued keep working. It will block renewals from any CA you leave off, so list every CA you rely on, including ones used by your CDN or hosting provider.

Only if you want different rules. Without issuewild, the issue records also govern wildcards. Add 0 issuewild ";" to forbid wildcards entirely.

Use letsencrypt.org. Other common values are digicert.com, sectigo.com, pki.goog (Google Trust Services) and amazon.com (AWS Certificate Manager).

Flag 128 marks a tag as critical: a CA that does not understand the tag must refuse to issue. For the standard issue, issuewild and iodef tags use flag 0.