A CAA (Certification Authority Authorization) record lists the certificate authorities allowed to issue TLS certificates for a domain. Publicly trusted CAs must check it before every issuance.
google.com. 75947 IN CAA 0 issue "pki.goog"
; Google Trust Services may issue certificates
github.com. 1615 IN CAA 0 issue "digicert.com" ; DigiCert may issue certificates github.com. 1615 IN CAA 0 issue "globalsign.com" ; GlobalSign may issue certificates github.com. 1615 IN CAA 0 issue "letsencrypt.org" ; Let's Encrypt may issue certificates github.com. 1615 IN CAA 0 issue "sectigo.com" ; Sectigo (also issues for ZeroSSL) may issue certificates github.com. 1615 IN CAA 0 issuewild "digicert.com" ; DigiCert may issue wildcard certificates github.com. 1615 IN CAA 0 issuewild "letsencrypt.org" ; Let's Encrypt may issue wildcard certificates github.com. 1615 IN CAA 0 issuewild "sectigo.com" ; Sectigo (also issues for ZeroSSL) may issue wildcard certificates
paypal.com. 3600 IN CAA 0 issue "digicert.com" ; DigiCert may issue certificates paypal.com. 3600 IN CAA 0 issue "quovadisglobal.com" ; DigiCert (QuoVadis) may issue certificates paypal.com. 3600 IN CAA 0 issue "visa.com" ; visa.com may issue certificates
gmail.com. 86400 IN CAA 0 issue "digicert.com" ; DigiCert may issue certificates gmail.com. 86400 IN CAA 0 issue "pki.goog" ; Google Trust Services may issue certificates
Before issuing for www.shop.example.com, a CA queries CAA at that name. If the answer is empty it climbs to shop.example.com, then example.com, stopping at the first name that has a CAA set. If none is found anywhere, any CA may issue. The relevant set completely replaces any set higher up the tree, so a subdomain with its own CAA records does not inherit the parent's.
The CA/Browser Forum Baseline Requirements have made CAA checking mandatory since 2017. RFC 8657 adds parameters that tie issuance to a specific ACME account (accounturi) or validation method (validationmethods).
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"Wire format: RDATA is a flags octet, a tag length octet, the tag (ASCII), then the value (the rest of the RDATA).
| Field | Meaning |
|---|---|
| Flags | 0, or 128 (issuer critical): a CA that does not understand the tag must refuse to issue. |
| issue | Issuer domain of a CA allowed to issue any certificate, e.g. letsencrypt.org, pki.goog, digicert.com. A value of ; means none. |
| issuewild | Same, for wildcard certificates only. If present it overrides issue for wildcards. |
| iodef | Where a CA may report a refused request: mailto: or https: URL. |
issuewild ";" while relying on a wildcard certificate."Sectigo") instead of its issuer domain (sectigo.com).