DNS & Glossary

CAA record (Certification Authority Authorization)

A security record that whitelists which certificate authorities may issue certificates for your domain, blocking unauthorized or mistaken issuance.

What it stores

A CAA record names the CAs allowed to issue certificates for the domain. Before issuing, a compliant CA must check CAA and refuse if it is not listed. This limits the blast radius of a compromised or tricked CA.

ZONE FILE
example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 iodef "mailto:[email protected]"

Why it matters

  • It reduces the risk of certificate mis-issuance to your domain by any of the hundreds of trusted CAs.
  • The iodef tag lets CAs report policy-violating requests to you.

Common mistakes

  • Setting a CAA record that omits the CA you actually use, blocking your own renewals.
  • Assuming CAA replaces monitoring — pair it with Certificate Transparency logs.

How WebInspect checks this

  • WebInspect reports the presence and contents of CAA records in its security analysis.