CAA records

A CAA record names which certificate authorities are allowed to issue certificates for your domain. Since 2017 every publicly trusted CA has been required to check it before issuing, and to refuse if the record exists and does not list them.

With no CAA record, any of the hundreds of publicly trusted CAs may issue for your domain to anyone who can satisfy their validation process. CAA does not stop a compromise of that process, but it does mean an attacker has to compromise one of the CAs you named rather than any of them.

The issue property covers ordinary certificates and issuewild covers wildcards, which can be restricted separately or forbidden entirely. The iodef property gives a contact address for a CA to report a refused request to — which is a genuinely useful early warning that somebody tried.

CAA is checked at issuance, not at validation. Adding a record does nothing to certificates that already exist, and removing one does not revoke anything.

Publish a record naming the CAs you actually use — usually one or two. 0 issue "letsencrypt.org" is the whole of it for most sites.

Add 0 iodef "mailto:security@example.com" so a refused request reaches somebody. It is the only part of CAA that tells you anything.

Before publishing, check what is issuing certificates today, including anything automatic: a CDN or load balancer that provisions its own certificate uses a CA of its choosing, and a CAA record that omits it will break renewal at a moment nobody is watching. Certificate Transparency logs are the easiest way to see the full list.

If you use wildcards, issue covers them by default — issuewild is only needed if you want to restrict wildcard issuance to a different CA or forbid it entirely with 0 issuewild ";".