CAA lookup - certificate authority authorization

What a CAA record does

Certificate Authority Authorization lets a domain owner publish, in DNS, which certificate authorities are allowed to issue TLS certificates for that domain. A compliant CA checks this before issuing - so a domain with no CAA record allows any CA, while one that lists specific CAs is telling every other CA to refuse.

Reading the tags

• issue - authorizes a CA to issue ordinary certificates.
• issuewild - authorizes a CA specifically for wildcard certificates; without it, "issue" alone may not cover wildcards depending on the CA's policy.
• iodef - a URL or mailto: address a CA can notify if it receives (and refuses) a request that violates the policy.

Why it is worth publishing

It is a narrow but real defence: it does not stop a compromise of your DNS or your CA account, but it does stop a certificate being issued by a CA you never intended to use - whether by mistake, a misconfigured integration, or an attacker with partial access who has not compromised DNS itself.

Related tools

Once a certificate exists, checking it directly is on the roadmap - see the SSL/TLS tools noted on the Website & Network Tools category page.