Among the DNS records you can set for your domain, the CAA record is a small but powerful security control most people have never heard of — it lets you dictate exactly which certificate authorities are allowed to issue SSL/TLS certificates for your domain. It is an optional extra layer that guards against one specific, serious risk: someone obtaining a fraudulent certificate in your domain’s name.

This guide explains what a CAA record is, the security problem it solves, how it works as a whitelist, the mandatory check that makes it effective, its key components, how to add one, and whether you need it. By the end, this niche-but-valuable record will make clear sense as part of a well-secured domain.

What a CAA record is

A CAA (Certification Authority Authorization) record is a type of DNS record that lets domain owners specify which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for their domain. In other words, it is a DNS entry where you name the CAs you authorize, and by implication forbid all others from issuing certificates for your domain.

SSL/TLS certificates are what enable the secure, encrypted HTTPS connection between browsers and your website. They are issued by certificate authorities after verifying that the requester controls the domain. A CAA record adds a control on top of that: it declares, at the DNS level, which CAs you permit to issue for you.

So the CAA record is a preventative security measure. It does not issue or manage your certificates itself; rather, it constrains who is allowed to issue them, reducing the risk that an unauthorized or mistaken certificate could be created for your domain by a CA you never intended to use.

The security problem it solves

The risk a CAA record addresses is unauthorized or mis-issued certificates. Normally, any public certificate authority can issue a certificate for any domain after validating control of it. That flexibility is convenient, but it means that if an attacker managed to trick a CA, or a CA made a mistake, a fraudulent certificate could be issued for your domain without your knowledge.

A fraudulent certificate is dangerous because it could let an attacker impersonate your secure site convincingly — presenting a valid-looking HTTPS padlock on a malicious server pretending to be you. Constraining which CAs may issue for your domain shrinks that attack surface dramatically.

By publishing a CAA record that names only your chosen CA (or CAs), you instruct every other authority not to issue certificates for your domain at all. This closes the door on mis-issuance from CAs you do not use, adding a targeted layer of protection around your domain’s certificates.

How it works as a whitelist

A CAA record functions as a whitelist. The logic is simple: if a domain has no CAA records, any public CA can issue a certificate for it after validating domain control. But if CAA records exist, only the CAs listed in them are permitted to issue certificates — everyone else is refused.

So by adding a CAA record naming your certificate authority, you switch your domain from “any CA may issue” to “only these named CAs may issue.” This is what makes it a preventative control: it explicitly limits issuance to authorities you trust, rather than leaving it open to all.

The whitelist model is elegant because it is opt-in and precise. You are not blocking anything by default; you are affirmatively declaring who is allowed. Any CA not on your list is expected to decline to issue for your domain, which is exactly the restriction you want if you use a specific, fixed certificate provider.

The mandatory check that makes it work

A whitelist is only useful if it is actually consulted — and that is precisely what makes CAA records effective. Since September 2017, all public certificate authorities have been required by industry standards to check a domain’s CAA records before issuing any certificate. This mandatory check is what gives the record real force.

Because compliant CAs must look up your CAA record and honour it, a CA that is not on your list is obligated to refuse issuance for your domain. This turns your published preference into an enforced rule across the public CA ecosystem, not just a suggestion.

This industry-wide requirement is why a CAA record is worth setting: it is not an obscure flag that gets ignored, but a control that every legitimate certificate authority is bound to respect. Publishing one meaningfully constrains who can issue certificates for your domain, backed by the standards CAs must follow.

Key components and inheritance

CAA records use specific property tags to define their rules, and they follow a helpful inheritance behaviour. Here are the essentials.

• issue: authorizes a specific CA to issue standard certificates for the domain (you name the CA’s identifying domain).
• issuewild: authorizes issuance of wildcard certificates specifically.
• iodef: provides a contact (such as an email or URL) where CAs can report policy-violation attempts.
• Subdomain inheritance: a CAA record on your root domain automatically applies to all subdomains (like mail.example.com) unless a more specific record overrides it.

In practice you typically set an issue tag naming your certificate authority on your root domain, and thanks to inheritance it covers your subdomains too. The issuewild tag lets you control wildcard certificates separately, and iodef gives CAs a way to alert you to attempted violations — a useful bonus for monitoring.

How to add a CAA record

Adding a CAA record is done in your DNS editor, like any other record. You create a new record of type CAA, set the name to your root domain (@) so it covers the whole domain via inheritance, and configure the tag and value — most commonly an issue tag naming the certificate authority you use.

The specific value you enter is the identifying domain of your chosen CA, which your certificate provider or host will tell you. If you use wildcard certificates, you may add an issuewild entry as well, and you can optionally add an iodef entry with a contact for violation reports.

After saving, allow time for propagation like any DNS change. From then on, compliant CAs checking your domain will see the record and only your authorized CA (or CAs) will be able to issue certificates. It is a set-and-forget control: once configured correctly for the CA you use, it quietly enforces your certificate policy.

Do you need a CAA record?

A CAA record is optional, and whether you need one depends on your situation. It is a genuinely useful extra layer of security, especially valuable when you use a fixed, known certificate authority and want to guarantee no other CA can issue for your domain. For security-conscious owners and higher-stakes sites, it is a worthwhile addition.

For a simple site, it is not mandatory, and many domains operate perfectly well without one — SSL/TLS still works, and domain-control validation still protects issuance. The CAA record is an enhancement to that baseline, not a requirement for HTTPS to function.

The practical guidance: if you know which CA issues your certificates and want to lock issuance to it, add a CAA record — it is a low-effort, meaningful hardening step. If your certificate setup is managed automatically by your host and you have no specific need, it is a reasonable optional extra rather than something you must have. Either way, it complements, and does not replace, your certificate itself and your other DNS and account security measures.

FAQs

What is a CAA record?

A CAA (Certification Authority Authorization) record is a DNS record that specifies which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. By naming your authorized CAs, it prevents all others from issuing certificates for you — a preventative security control against unauthorized or mis-issued certificates.

What problem does a CAA record solve?

It guards against unauthorized or mis-issued SSL/TLS certificates. Normally any public CA can issue a certificate for any domain after validating control, so a tricked or mistaken CA could create a fraudulent certificate for your domain. A CAA record limits issuance to CAs you name, shrinking that risk of impersonation.

How does a CAA record work?

As a whitelist. If a domain has no CAA records, any public CA may issue certificates for it; if CAA records exist, only the listed CAs are permitted. Since September 2017, all public CAs are required to check a domain’s CAA records before issuing, so a CA not on your list must refuse — making the record enforceable.

What are the parts of a CAA record?

Property tags define the rules: issue authorizes a specific CA for standard certificates, issuewild authorizes wildcard certificates, and iodef gives a contact for reporting violation attempts. A CAA record on your root domain also automatically applies to all subdomains through inheritance, unless a more specific record overrides it.

How do I add a CAA record?

In your DNS editor, create a record of type CAA, set the name to your root domain (@), and configure the tag and value — usually an issue tag naming your certificate authority’s identifying domain (your CA or host provides it). Add issuewild for wildcard certs if needed, save, and allow time for propagation.

Do I need a CAA record?

It’s optional but a useful extra security layer, especially if you use a fixed, known certificate authority and want to ensure no other CA can issue for your domain. Simple sites work fine without one — HTTPS still functions. If you know your CA and want to lock issuance to it, it’s a low-effort hardening step worth adding.

The bottom line

A CAA (Certification Authority Authorization) record is a DNS record that lets you specify exactly which certificate authorities may issue SSL/TLS certificates for your domain — a targeted security control against unauthorized or mis-issued certificates. It works as a whitelist: with no CAA record, any public CA can issue for your domain, but once you publish one naming your chosen CA, only those authorities are permitted and all others must refuse. Crucially, since 2017 every public CA is required to check a domain’s CAA records before issuing, which turns your published preference into an enforced rule across the certificate ecosystem.

You set it with property tags — issue for standard certificates, issuewild for wildcards, and iodef for violation reports — placing it on your root domain, where inheritance extends it to your subdomains. Adding one is a simple DNS-editor task once you know which CA you use. It is optional and not required for HTTPS to work, but for anyone using a fixed certificate authority who wants to guarantee no one else can issue in their name, it is a low-effort, meaningful hardening step. Treat it as a valuable complement to your certificate and your other DNS and account security — a small record that quietly enforces exactly who is trusted to vouch for your domain.

When you are ready, you can start with Hostinger and use code PROTIPS for the reader discount. A CAA record names which certificate authorities may issue SSL/TLS certificates for your domain, working as an enforced whitelist (all public CAs must check it since 2017). Optional but a useful hardening step; set an issue tag on your root domain in your DNS editor.