What is a CAA record and do I need one?
What CAA does
Certification Authority Authorization records tell certificate authorities which ones are allowed to issue certificates for a domain. Before issuing a certificate, a well-behaved authority checks the CAA records. If none exist, any authority may issue a certificate, which is the default behavior.
CAA can also include an email or URL to report issues. It is a helpful safety measure, but it does not protect against every kind of misuse, and it has no effect on sites that are not checked by authorities that honor it.
- Lists approved certificate authorities
- Optional for most small sites
- Can include an address for issue reports
When to add one
Add a CAA record if you use one certificate provider and want to limit issuance to that provider. Make sure the record names the correct authority, because a typo can block a valid renewal. Test renewal after adding it.
If you change certificate providers later, update the CAA record first so the new provider can issue. Otherwise renewal may fail.
Many certificate providers check CAA automatically during issuance, so a mistake here can show up as a failed order rather than a warning. Review the record after any provider change.
Common mistakes
- Adding a CAA record that names the wrong authority and blocking renewal.
- Forgetting to update CAA when switching certificate providers.
