# CAA record

Canonical: https://inetgeek.com/dns/caa-record/

A CAA record states which certificate authorities are allowed to issue certificates for your domain.

## What a CAA record does

A CAA record, defined in RFC 8659, names a certificate authority permitted to issue certificates for a domain. Authorities are required to check CAA records before issuing.
Publishing no CAA record means any authority may issue. CAA is a restriction, so its absence is permissive rather than restrictive.

## Tags and inheritance

The "issue" tag authorises normal certificates and "issuewild" authorises wildcards. The "iodef" tag gives a contact address for reporting requests that were refused.
Lookups walk up the domain tree: an authority checking sub.example.com that finds nothing there will check example.com next. A record at the apex therefore governs subdomains unless one overrides it.

(Interactive explainer on the canonical page — nothing to check live, this is reference text.)

## What it does and does not protect

CAA reduces the risk of an unauthorised certificate being issued by an authority you do not use. It is a control on issuance, not on validation.
It has no effect on certificates that already exist, and it does not stop anyone who can pass an authority's domain validation for an authority you have authorised.

Check this on a live domain: https://inetgeek.com/tools/dns-lookup/

## Related records

- [DNSSEC](https://inetgeek.com/dns/dnssec/): Signs DNS answers so resolvers can detect tampering.
- [TXT record](https://inetgeek.com/dns/txt-record/): Holds arbitrary text, used for verification and email policy.