Glossary · ENCheck a domain

CAA record

A CAA record is a DNS record that lets a domain owner state which public certificate issuers are authorized to issue certificates for the domain. A certificate authority, or CA, is an organization that issues certificates browsers and other clients may trust. CAA adds a check before certificate issuance; it does not itself issue or validate a certificate.

How does a CAA record affect a certificate?

When a CA is asked to issue a certificate, it checks the domain's applicable CAA records. A record can authorize a CA identifier to issue certificates, or include other supported instructions. If no CAA record is found, the CAA mechanism does not restrict issuance. If a record exists, a CA must follow the applicable CAA rules before issuing.

For example, if example.com publishes a CAA record authorizing one CA, another CA should not issue a certificate for that domain unless the record or policy permits it. This can reduce the risk of unintended certificate issuance, but it is not a complete defense against incorrect certificate issuance or an attacker taking over an account.

CAA records are separate from the certificate itself. Browsers do not normally use current CAA records to decide whether an already issued certificate is valid. To check a website connection, clients validate the certificate and connection according to their trust rules.

Related terms