What happens without a CAA record?

If CAA is missing from the entire chain, every public certification authority may issue for the domain. That is the default state of most domains and not an error.

How do I create a CAA record?

At the zone apex set a record of the form 0 issue "letsencrypt.org", taking the exact CA identifier from the documentation of the desired CA. For wildcards additionally 0 issuewild "...". Multiple CAs each get their own issue entry. Optionally 0 iodef "mailto:security@example.com".

My certificate request fails on CAA, what should I do?

Check whether the CA identifier stored in the CAA record matches exactly what the CA requires, and whether a record at the concrete subdomain overrides the parent level. For wildcards, issuewild must match, not just issue.

What does an issue value of exactly ';' mean?

A value of exactly ';' forbids every certification authority from issuing, even if the domain itself needs no certificate right now. Useful for domains that should never have a certificate.

What is the difference between issue and issuewild?

issue applies to normal certificates, issuewild specifically to wildcard certificates such as *.example.com. If issuewild is missing, issue automatically applies to wildcards too (RFC 8659 section 4.2).

iodef names a mail or web address to which certification authorities can report unauthorised issuance attempts. Optional; a missing entry is only a note, not an error.

CAA Check

Check a domain's CAA records: which certification authorities may issue.

A CAA record (Certification Authority Authorization) states which certification authorities may issue certificates for a domain at all. A CA must query the CAA records before every issuance and may refuse if it does not find itself there, no matter who makes the request. CAA is thus a simple, effective brake against the misissuance of certificates for your own domain.

What this tool checks

CAA is inherited up the name chain. The tool climbs upward from the given domain until it finds a level with CAA records or reaches the registrable domain (climbing higher would be meaningless). It evaluates the tags per RFC 8659: issue (normal certificates), issuewild (wildcard certificates) and iodef (contact for reports). An issue value of exactly ; is a full issuance ban. The critical flag of unknown tags is detected. The actual issuer of a live certificate is deliberately not cross-checked, there is the Certificate Check for that.

Reading the result

No CAA record anywhere in the chain means: every public CA may issue. That is the default state of most domains and is shown as info, not as an error. If records are present, issue and issuewild are listed separately; if issuewild is missing, issue also applies to wildcards. An explicit ban (;) and an unknown tag with the critical flag set appear as a warning, a missing iodef contact only as a note.

Background

CAA is defined in RFC 8659 (record format, inheritance over the name chain, behaviour with a missing issuewild in section 4.2, critical flag in section 4.1). RFC 8657 adds parameters for binding to a specific CA account (accounturi) and to a validation method (validationmethods). The older RFC 6844 is obsolete; since then CAA is checked at the concrete name and then upward, no longer along CNAME chains and DNAMEs as in the old procedure.

Common problems and how to fix them

Certificate request fails with a CAA error. The CA identifier stored in the CAA record does not match what the chosen CA expects (for example letsencrypt.org instead of 0 issue "letsencrypt.org"). Enter the value exactly as documented by the CA.
Wildcard certificate is refused, a normal one works. An issuewild entry for the CA is missing, or issuewild names a different CA. Add a matching issuewild record.
CAA at the zone apex, but a certificate for a subdomain is stuck. A CAA record directly at the subdomain overrides the parent level entirely, it is not merged. If the subdomain record then does not contain the required CA, issuance fails.
Unintended total ban. An issue ";" blocks every issuance. If that is not intended, replace the value with the permitted CA.
Old or superfluous CA in the record. After a CA change, remove the old issue entry, otherwise the former CA could keep issuing.

Common questions

What happens without a CAA record?: If CAA is missing from the entire chain, every public certification authority may issue for the domain. That is the default state of most domains and not an error.
How do I create a CAA record?: At the zone apex set a record of the form 0 issue "letsencrypt.org", taking the exact CA identifier from the documentation of the desired CA. For wildcards additionally 0 issuewild "...". Multiple CAs each get their own issue entry. Optionally 0 iodef "mailto:security@example.com".
My certificate request fails on CAA, what should I do?: Check whether the CA identifier stored in the CAA record matches exactly what the CA requires, and whether a record at the concrete subdomain overrides the parent level. For wildcards, issuewild must match, not just issue.
What does an issue value of exactly ';' mean?: A value of exactly ';' forbids every certification authority from issuing, even if the domain itself needs no certificate right now. Useful for domains that should never have a certificate.
What is the difference between issue and issuewild?: issue applies to normal certificates, issuewild specifically to wildcard certificates such as *.example.com. If issuewild is missing, issue automatically applies to wildcards too (RFC 8659 section 4.2).
What is iodef for?: iodef names a mail or web address to which certification authorities can report unauthorised issuance attempts. Optional; a missing entry is only a note, not an error.