What is a CAA record and how to set it up in DNS?

A Certification Authority Authorization (CAA) record is a DNS record that specifies which Certification Authorities (CAs) are allowed to issue SSL/TLS certificates for a domain.

Since September 8, 2017, all public CAs are required to check the CAA record before issuing a certificate, according to CA/Browser Forum requirements. If a CAA record exists and the CA is not listed, the certificate request must be rejected.

If no CAA record is present for a domain, any public CA may issue a certificate for it. Once a CAA record is set, only the listed CA(s) may issue certificates.

Example format of a CAA record:

Tag values:

• issue: Authorizes the CA to issue certificates for the domain.
• issuewild: Authorizes issuance of wildcard certificates. To explicitly disallow wildcard certificates, you can set 0 issuewild ";".

Generating a CAA record:

You can easily generate CAA records using online tools such as SSLMate's CAA Record Helper. It allows you to select the preferred CA, decide on wildcard issuance, and generate the correct DNS record format for your domain.

Popular Certification Authorities:

DigiCert (including GeoTrust and RapidSSL)
       issue "digicert.com"

Let's Encrypt
       issue "letsencrypt.org"