---
title: "CAA record"
description: "A CAA record specifies which certificate authorities may issue SSL certificates for your domain. Learn its structure and its role in domain security."
url: "https://nodea.io/en/glossary/caa-record"
lang: "en"
updated: "2026-07-13"
---

# CAA record

> A CAA record is a DNS entry that states which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for a given domain.

A **CAA record** (*Certification Authority Authorization*) is a [DNS zone](https://nodea.io/en/glossary/dns) entry that specifies which certificate authorities (CAs) are allowed to issue [SSL/TLS](https://nodea.io/en/glossary/ssl) certificates for a given domain. It is a defensive mechanism: it reduces the risk that an unauthorized or misbehaving authority will issue a certificate for someone else's domain.

## What a CAA record involves

A CAA entry ties a domain to a certificate authority's name and consists of three elements:

- **flag** — usually *0*; the criticality value of the entry,
- **tag** — *issue* (regular certificates), *issuewild* (wildcard certificates) or *iodef* (an address for reporting violations),
- **value** — the domain of the authorized CA, e.g. *letsencrypt.org*.

Per the standard, every certificate authority must check a domain's CAA records before issuing a certificate. If its name is not on the list, the request is rejected. To make the entry trustworthy, it is worth combining CAA with [DNSSEC](https://nodea.io/en/glossary/dnssec), which protects the zone from being forged.

## The CAA record in practice

You add a CAA record to keep discipline over who issues certificates for your company domains — for example limiting issuance to a single trusted authority such as [Let's Encrypt](https://nodea.io/en/glossary/lets-encrypt-ssl-certificates) or a commercial provider. The entry is configured in the DNS panel; just remember that too narrow a list will block automatic certificate renewal by another tool. It is a simple, often overlooked piece of domain security hygiene.

### Does the absence of a CAA record block certificate issuance?

No. When a domain has no CAA record, any certificate authority may issue a certificate for it — that is the default. A CAA record is used to narrow that list; only its presence restricts issuance to the named CAs.

## Related

- [SSL](https://nodea.io/en/glossary/ssl)
- [DNS](https://nodea.io/en/glossary/dns)
- [Let's Encrypt (SSL certificates)](https://nodea.io/en/glossary/lets-encrypt-ssl-certificates)
- [DNSSEC](https://nodea.io/en/glossary/dnssec)
- [TLS](https://nodea.io/en/glossary/tls)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/rekord-caa.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)