A Certification Authority Authorization (CAA) record lets a domain owner specify which certificate authorities may issue TLS certificates for the domain. Before issuing a certificate, a CA checks the applicable CAA policy in DNS. CAA restricts issuance; it does not validate certificates that have already been issued or replace the CA’s other identity and domain-control checks.
What a CAA record does
CAA is a DNS resource record used to publish certificate-issuance authorization for a domain. It can name one or more certificate authorities (CAs) that the domain holder permits to issue certificates containing that name. The current specification is RFC 8659; Let’s Encrypt’s CAA documentation describes the same purpose for site owners.
Think of CAA as an instruction to certificate issuers: before issuing, check whether the domain’s DNS policy permits you to issue. It is not a certificate itself, a browser trust setting, or proof that an issuance request is otherwise valid. As RFC 8659 makes clear, satisfying a published CAA record is necessary but not sufficient: the CA still has to meet its other certificate-policy and domain-control requirements.
How a CA finds the policy
For every fully qualified domain name (FQDN) in a certificate request, the CA looks for the applicable CAA record set (RRset). It starts at the requested name and walks upward through its parent DNS names until it finds a CAA RRset. That means a policy published at a parent name can govern a subdomain that has no CAA record of its own. See the lookup rules in RFC 8659.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
If the CA finds restrictive issue records, the requested issuer must be authorized by the applicable policy, subject to any applicable certificate-policy exception. If no relevant CAA RRset is found, CAA itself imposes no restriction on which CA may issue. Under RFC 8659, a found RRset with only non-restrictive or unrecognized property tags also does not restrict issuance.
A certificate can cover multiple names, including wildcard names. The CA must evaluate the applicable CAA policy for every name requested. Let’s Encrypt’s published policy says it checks CAA for each dNSName in the certificate’s subjectAltName; where it issues, issuance must occur within the CAA record TTL or eight hours, whichever is greater. That timing rule is specific to the cited Let’s Encrypt policy, not a universal promise about every CA.
CAA record syntax and the issue property
The standard presentation form is:
CAA <flags> <tag> <value>
- Flags: An unsigned integer from 0 through 255. The flag’s meaning depends on the specification and property behavior; use the value and guidance required by the CA or DNS provider rather than guessing.
- Tag: A non-empty sequence of lowercase ASCII letters and numbers naming the property. The principal issuer-authorization property is
issue. - Value: The property data. For an
issuerecord, this identifies the issuer domain value specified by the CA.
For example, a record is conceptually made up of the CAA type, a flags number, the issue tag, and the chosen CA’s documented issuer value. The exact value is CA-specific, so do not copy a value from an unrelated provider or infer one from a brand name. Take it from the selected CA’s current documentation and enter it in the format your DNS host requires.
How to allow only Let’s Encrypt
To restrict issuance to Let’s Encrypt, publish the issue authorization value that Let’s Encrypt currently documents for your DNS provider’s CAA editor. This is a DNS-provider configuration task, and console labels differ by provider; there is no universal click path. Follow the provider’s current instructions and verify the resulting public DNS data before relying on it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Choose the authorized CA. Confirm that Let’s Encrypt is the CA your production and renewal automation will use. Include any other CA only if your organization intentionally needs it.
- Open the DNS zone for the relevant name. Use the DNS host’s record editor and select the CAA record type. Choose the name or host field appropriate to the domain or subdomain you intend to govern.
- Enter the record components. Use the provider’s documented field layout for flags, tag (
issue) and the issuer value specified by Let’s Encrypt. Do not assume every DNS editor accepts the presentation format as one text field. - Keep renewals aligned. If renewal automation uses a different CA, that issuer must also be intentionally authorized or the renewal can fail. Publish one authorization entry for each CA you mean to permit.
- Query the visible policy. Check CAA for the exact requested hostname and its parents. Confirm which RRset is returned and whether it authorizes the intended issuer.
- Run issuance or renewal. If the CA rejects the request, read its CAA-specific error and recheck the RRset that the CA can see, including parent-name policy and DNS caching.
Subdomains, wildcards, and multiple names
CAA follows the DNS name hierarchy, so the nearest applicable RRset matters. A subdomain with its own CAA RRset is evaluated against that set; if no set exists there, the lookup can reach a parent RRset. When comparing policies, consider both the exact names covered and where each record sits in the hierarchy.
For a certificate request with several subject alternative names, authorization for one name does not automatically settle the others. The issuer checks each requested FQDN and wildcard name under the applicable CAA rules. Before deployment, inventory the names in the certificate request, identify the RRset that controls each one, and confirm each allows the CA used by issuance and renewal automation.
What CAA does not protect
CAA is an issuance control, not an ongoing certificate-validation mechanism. Browsers and other relying parties do not use a domain’s current CAA record to decide whether an already-presented certificate is valid. A certificate that was issued under an earlier policy may remain valid after the DNS policy changes; the current record describes the authorization in force for issuance, not necessarily the policy that applied when an existing certificate was issued. See RFC 8659.
CAA also does not bypass the issuer’s other checks. An authorized CA must still apply its certificate policies and verify control of the domain as required. If your concern is an existing certificate, assess that certificate under the relevant validation and revocation mechanisms rather than treating the current CAA record as a verdict on it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to compare or review CAA policies
When checking whether a policy matches your operational intent, review the following together:
- Authorized issuers: Does each
issuevalue correspond to a CA you deliberately use? - Name coverage: Which parent RRset controls each hostname, subdomain, and wildcard in the certificate request?
- Renewal behavior: Does the policy authorize the same CA that automated renewals actually call?
- Change timing: Has the DNS TTL elapsed, and could resolver caching mean a CA still sees an earlier value?
- Additional properties: Does your organization need reporting or incident-contact properties as well as issuer authorization? Do not assume those properties are required to authorize an issuer.
The relevant processing and syntax rules are in RFC 8659; the timing requirement described above is in Let’s Encrypt’s published policy documentation. DNS interfaces and issuer values remain provider- and CA-specific.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting CAA errors
The CA says issuance is forbidden by CAA
The RRset visible to that CA may not authorize the issuer it is using. Query the exact requested name, then walk its parent names to locate the controlling RRset. Check that the issue value matches the CA’s documented issuer value and that you have not omitted a CA used by renewal automation.
A subdomain fails although the apex appears correct
The subdomain may have its own restrictive RRset, or it may inherit a different policy from a parent label. Inspect CAA at the full hostname and each parent rather than checking only the domain apex. Also evaluate every SAN and wildcard name in the request.
The DNS editor accepted the change, but issuance still fails
A successful save in the control panel does not establish what the CA’s resolver sees. Confirm the authoritative and publicly visible CAA answers, then allow for the record TTL and resolver caching. A CA may continue to observe an earlier RRset until caches expire.
A new policy seems to contradict an existing certificate
That is not necessarily a conflict. CAA governs authorization at issuance time and is not used by relying parties to validate a certificate already issued. Check when the certificate was issued and evaluate its validity separately from today’s CAA policy.
The request includes several names and only some pass
CAA evaluation applies to each requested FQDN and wildcard. Identify the controlling RRset for every name and make sure the selected CA is authorized for all of them before retrying issuance.
Or skip the browser setup
CAA is configured in DNS, not by taking a browser screenshot; for website evidence or visual checks alongside your deployment work, ScreenshotNeo offers a one-request screenshot API and MCP server. Its API returns a screenshot or PDF from a URL. For example, save a PNG response with cURL:
ScreenshotNeo API documentation
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp
Quick Recap
ScreenshotNeo accepts cookie and consent banners and removes more than 60 known consent platforms, newsletter popups and chat widgets before capture; each cleanup step can be turned off. Bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing status. An MCP server exposes take_screenshot, get_page_info and capture_pdf for Claude, Cursor and other MCP clients. The Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Sign up for free: 1,000 screenshots a month, no card required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
