A CAA record defines which certificate authorities can issue certificates for a domain. It serves as a safeguard. An unlisted authority must refuse issuance. CAA works through inheritance. Without a rule on a subdomain, the apex rule applies.
A CAA record contains a name, a type, a flag, a tag, a value, and a TTL. The TTL indicates how long the response remains cached in the local resolver.
| Name | Type | Flag | Tag | Value | TTL in seconds |
|---|
| @ | CAA | 0 | issue | "letsencrypt.org" | 3600 |
In this example, the zone authorizes Let's Encrypt to issue certificates for the domain. A flag of zero is suitable for common uses. A TTL of 3600 corresponds to one hour.
| Name | Type | Flag | Tag | Value | Role |
|---|
| @ | CAA | 0 | issue | "digicert.com" | Authorize an authority |
| @ | CAA | 0 | issuewild | "letsencrypt.org" | Authorize wildcard certificates |
| @ | CAA | 0 | iodef | "mailto:security@example.com" | Receive incident reports |
| @ | CAA | 0 | issue | ";" | Forbid all issuance |
The issue tag authorizes the issuance of standard certificates. The issuewild tag targets wildcard certificates. The iodef tag indicates where to send a report in case of unauthorized attempts.
Publish the CAA at the apex to cover the entire domain. Define exceptions at the subdomain level if needed.
The target of an MX or other service does not affect the CAA. The issuance decision is made on the name of the targeted certificate.
The critical flag exists for advanced uses. A value of one hundred twenty-eight requires the authority to understand the tag or it refuses.
A short TTL makes an adjustment visible faster. Useful during an authority change.
A medium or long TTL reduces queries to authoritative servers. Suitable for a stable policy.
Reduce the TTL a few hours before switching, then increase it after validation.
Good to know
Inheritance is key. A rule set on shop.example.com replaces that of the apex for this subdomain. Without a local rule, the parent rule applies.
At the apex to define the general policy. On a subdomain to grant a controlled exception like a service managed by a third party. Then test actual issuance with the targeted authority.
To avoid
Forgetting the iodef which facilitates reporting.
Authorizing too many authorities which complicates control.
Leaving an old CAA active after a provider change.
An online DNS lookup allows entering a domain name. The result displays the CAA tags and TTL visible from the Internet. It's a useful first check. Then perform a local test from your machine.
Windows provides nslookup. It can be used in interactive mode.
nslookup
set q=caa
example.com
nslookup
set q=caa
server 1.1.1.1
example.com
The first part queries according to the machine's network configuration. The second forces the use of a third-party resolver, here Cloudflare's.
On these systems, the dig command is practical and easy to use.
dig CAA example.com
dig CAA example.com @1.1.1.1
The presence of an issue or issuewild tag indicates the authorized authority. A value with semicolon alone forbids issuance.
A high remaining TTL may explain a lag after a change.
Total absence of CAA means no restriction. Authorities can issue according to their usual controls.
- List the chosen authority and any wildcard need.
- Publish CAA at the apex with a reduced TTL.
- Add iodef to a functional contact address.
- Test issuance of a test certificate with the authority.
- Increase the TTL when everything is validated.
Practical tip
Keep a record with the list of published CAAs. Note the date, TTL, and reason for change. Keep proof of successful issuance tests.
Publish a single issue tag. Verify that all services go through this authority.
Add issuewild for the same authority. Keep issue for non-wildcard certificates.
Add iodef with a dedicated email or https reception address.
- If issuance fails, verify that the issue or issuewild tag properly mentions the targeted authority.
- If the authority requests a correction, verify inheritance up to the apex.
- If the change is not taken into account, wait for TTL expiration and purge the local resolver cache if possible.
In summary, a CAA record defines who can issue certificates for a domain. The issue, issuewild, and iodef tags cover most needs. Inheritance guides the decision. An adjusted TTL facilitates transition. Verification goes through an online tool then through nslookup and dig.
With these markers, management remains clear. Changes proceed without stress. Certificates are issued according to your policy.