What Is CAA?

At a glance

CAA is a DNS record that certificate authorities check before issuance to determine whether the domain authorizes them.

How CAA restricts certificate issuance

Certification Authority Authorization lets domain owners declare which certificate authorities may issue certificates for their names. Public CAs must check the applicable CAA policy before issuance. If a CA is not authorized, it must stop issuance or handle the condition as required by the specification.

The issue property governs ordinary certificates; issuewild can govern wildcard certificates separately. iodef can provide a policy-violation reporting address. CAA limits authorization before issuance: it does not decide whether browsers trust an existing certificate or automatically revoke an unexpected one.

Inheritance, aliases and multiple authorities

• Lookup begins at the target name. If it has no CAA record, the applicable rules allow searching parent names, so an apex policy can constrain subdomains.
• Aliases such as CNAME and DNAME affect the lookup path. When using a hosted platform, verify that its required CA is authorized by the policy that ultimately applies.
• Multiple issue records can authorize several CAs. An empty issue value can deny authorization for that class of issuance, but the syntax must be correct.
• Update CAA before switching a CDN, certificate service or automation platform. Otherwise, renewal may unexpectedly fail shortly before certificate expiry.

CAA versus certificate transparency

CAA constrains authorization before a certificate is issued. Certificate transparency provides public visibility into issuance events. Together they narrow the authorized issuer set and help reveal unexpected certificates.

CAA does not prevent compromise of an authorized CA account, loss of DNS control or misuse of private CAs. Nor does it protect a website's private key. Certificate security also requires renewal automation, private-key protection, CT monitoring and timely revocation.

Practical use and interpretation

A confirmed CAA response can show authorized authorities, wildcard rules and reporting addresses. Compare these with the current issuer, but do not assume a mismatch is a violation without checking parent inheritance, aliases and the CA's authorization identifier.

No CAA is a permitted default and usually means the domain does not impose this additional public-CA restriction. Incomplete queries leave the state unknown. A confirmed absence is not, by itself, evidence that the website is unsafe.

Points to consider

CAA narrows authorized issuance but does not replace certificate transparency monitoring or correct TLS configuration.

Frequently asked questions

Does having no CAA mean any CA automatically issues a certificate?

No. It means the domain has not restricted the eligible public CAs through CAA. Applicants still have to complete the relevant domain-control validation.

Will incorrect CAA immediately break existing HTTPS?

It normally does not invalidate an already issued, otherwise valid certificate, but it can block a new request or renewal. Test changes before the certificate expires.

Can CAA replace certificate transparency monitoring?

No. CAA restricts authorization before issuance; certificate transparency helps observe issuance events. They act at different stages.