When a visitor opens your business website, they expect to connect to the correct website securely. SSL/TLS certificates help establish that secure connection, but have you ever considered which certificate authorities are allowed to issue certificates for your domain?
This is where Certification Authority Authorization, commonly known as CAA, comes in.
CAA is a type of DNS record that allows a domain owner to specify which certificate authorities are authorised to issue certificates for a domain. It provides an additional layer of control over certificate issuance and can help reduce the risk of an unauthorised certificate being issued through a certificate authority that fails to check the domain’s intended policy.
For businesses that depend on their websites, customer portals and online services, CAA is a useful part of domain and certificate management.
What Is a CAA DNS Record?
A CAA record is a DNS record that identifies which certificate authorities are permitted to issue TLS certificates for a domain.
Certificate authorities, or CAs, are organisations that issue digital certificates used to establish trust in HTTPS connections. Before issuing a certificate, a CA must complete the relevant domain-control validation and follow its applicable issuance requirements.
Without a CAA policy, certificate issuance is generally not restricted by a domain-specific list of authorised certificate authorities. A CAA record allows a domain owner to publish such a restriction.
For example, a business that obtains its certificates through a particular certificate authority can publish a CAA record authorising that provider. Other certificate authorities that check CAA records are expected to respect the published policy.
CAA does not encrypt website traffic itself. HTTPS and TLS provide the encryption, while CAA helps control which certificate authorities may issue certificates for the domain.
Why Does CAA Matter for Business Websites?
A certificate is an important part of website trust. Incorrect or unauthorised certificate issuance can create additional risks for domain owners, particularly when combined with other weaknesses.
CAA helps businesses establish a clear certificate-issuance policy rather than leaving the choice entirely unrestricted at the DNS level.
It can be particularly useful for organisations that manage several domains, operate customer-facing applications or have formal processes for managing their certificates.
CAA also encourages better documentation. When a company knows which certificate authorities it uses, it becomes easier to identify unexpected certificate-related changes and investigate whether a new certificate was authorised.
However, CAA is not a replacement for domain account security, HTTPS configuration or certificate monitoring. It is one control within a broader security strategy.
How Does CAA Work?
The process begins when a domain owner publishes a CAA record in the domain’s DNS zone.
When a certificate authority is preparing to issue a certificate for a domain, it checks the applicable CAA policy as part of its issuance process. If the policy restricts issuance to particular certificate authorities, the issuing authority must follow the applicable rules.
If the requested certificate is not permitted by the published policy, the certificate authority should refuse issuance, subject to the relevant standards and exceptions.
CAA records can also define whether a certificate authority is permitted to issue wildcard certificates and identify a contact address for certificate-related reporting.
The important point is that CAA controls certificate issuance policy. It does not prevent every type of website compromise, nor does it stop an attacker from exploiting a website that already has a valid certificate.
Understanding the Main CAA Record Tags
CAA records contain a flag, a tag and a value. The tag describes the policy being published.
The issue Tag
The issue tag identifies a certificate authority that is authorised to issue ordinary certificates for the domain.
A domain can publish multiple issue records when it legitimately uses more than one certificate authority.
Before adding this tag, confirm the certificate authorities your website and related services actually use.
The issuewild Tag
The issuewild tag specifies certificate-issuance policy for wildcard certificates, which can cover a domain and its subdomains according to the certificate’s scope.
If a domain publishes an issuewild policy, certificate authorities must apply the relevant policy to wildcard certificate requests.
Wildcard certificates can simplify certificate management for organisations with many subdomains, but they should be used with an understanding of their scope and operational implications.
The iodef Tag
The iodef tag can specify a reporting destination for certificate-issuance policy violations.
Depending on the certificate authority’s support and implementation, this may be used to identify where relevant incident reports should be sent.
It is important not to assume that publishing an iodef record guarantees that every certificate authority will send reports to that address.
How to Add a CAA Record
The exact steps depend on where your domain’s authoritative DNS is managed. This may be your domain registrar, hosting provider or a DNS service such as Cloudflare.
Before making changes, identify which provider controls the authoritative DNS zone. Adding a record in a dashboard that is not authoritative for the domain will not necessarily affect public DNS responses.
Next, identify the certificate authority or authorities used by your website and any other services covered by the domain. Consult the relevant provider’s official CAA instructions to obtain the correct value.
In your DNS management panel, create a CAA record using the required fields:
- Type: CAA
- Name or host: The domain or hostname specified by your DNS provider
- Flag: The value required by the policy, commonly
0 - Tag: Such as
issue - Value: The certificate authority’s officially documented CAA identifier
The exact identifier must come from the certificate authority’s documentation. Do not guess it based on the provider’s brand name.
After publishing the record, verify that it appears in authoritative DNS and that the intended certificate authority is permitted to issue certificates.
Finally, document the policy and establish a process for updating it when your certificate provider changes.
Can CAA Records Break SSL Certificates?
CAA records do not normally interrupt an existing HTTPS connection simply because a policy has been published. Their main purpose is to influence certificate issuance.
However, an incorrect policy can prevent a legitimate certificate authority from issuing or renewing a certificate. If a certificate expires before a replacement can be issued, visitors may encounter certificate warnings or connection failures.
This is why businesses should not add restrictive CAA records without first confirming their certificate arrangements.
Pay particular attention to services that issue certificates automatically. A website might use one provider for its main domain while another platform issues certificates for a subdomain or integrated service.
If a certificate authority is omitted from the applicable policy, renewal may fail when that authority attempts to issue a replacement certificate.
Before changing CAA records, inventory the certificate authorities in use and test the intended configuration. If the domain supports important business services, plan the change carefully and monitor subsequent certificate issuance.
Does Cloudflare Support CAA Records?
Cloudflare supports DNS management for CAA records. If Cloudflare is the authoritative DNS provider for your domain, you can manage the relevant record through its DNS interface, subject to the current product capabilities and account configuration.
Using Cloudflare does not mean a restrictive CAA policy is automatically configured for every domain. The policy should reflect the certificate authorities that your services actually use.
Also remember that Cloudflare’s edge certificate and the certificate installed on your origin server are separate considerations in many website configurations. Your certificate setup depends on how Cloudflare connects to your origin and which services issue certificates for the relevant hostnames.
Do not copy a CAA policy from another website without understanding its certificate architecture.
For technical details, consult the official Cloudflare DNS documentation and your certificate authority’s CAA guidance.
CAA Is One Part of a Stronger Website Security Strategy
CAA can help restrict certificate issuance, but it does not replace the other controls needed to protect a business website.
Domain registrar accounts should be secured with strong authentication. DNS access should be limited to authorised administrators. Certificates should be renewed before expiry, and HTTPS should be configured correctly across the website.
Businesses should also maintain their applications, protect administrator accounts, keep reliable backups and use suitable traffic protection where appropriate.
Cloudflare-based protection can help manage website traffic and provide additional security capabilities, but those capabilities address different risks from CAA.
For businesses that want help with Cloudflare-based website protection, Tremhost Armor Guard provides a Cloudflare Pro-based service. You can also explore the wider Tremhost Cloudflare services.
Confirm the current service scope before purchasing, particularly if you need assistance with DNS policy, certificate issuance or renewal configuration.
Conclusion
CAA records give domain owners a way to specify which certificate authorities are authorised to issue certificates for their domains. When configured correctly, they add a useful control to certificate management and can reduce the risk of unauthorised issuance by certificate authorities that enforce the policy.
The most important step is to understand your existing certificate arrangements before publishing a restrictive record. A policy that is too narrow can interfere with legitimate certificate issuance and renewal.
Review your domain’s DNS configuration, confirm which certificate authorities your services use, publish the appropriate records and verify the result.
CAA is not a complete website security solution, but it is a valuable additional control for businesses that want better oversight of their domain and certificate infrastructure.
