CAA Records Explained: Stopping Unauthorized Certificate Authorities From Issuing Certs for Your Domain

A CAA (Certification Authority Authorization) record, defined in RFC 8659, is a DNS record type that lets a domain owner publish an explicit allowlist of which certificate authorities are permitted to issue TLS certificates for it. Since 2017, the CA/Browser Forum's baseline requirements have made checking CAA mandatory for every publicly trusted CA before issuing a certificate — so the record is actually enforced, not just advisory. A CAA record has three possible tags: issue authorizes a CA to issue regular certificates, issuewild authorizes wildcard certificates specifically (and can name a different, more restrictive CA than issue), and iodef specifies a URL or email address where a CA should report an attempted unauthorized issuance. The consequence of having no CAA record at all is easy to miss: it doesn't mean "no certificates can be issued" — it means any of the roughly 100 publicly trusted CAs, including Let's Encrypt, DigiCert, Sectigo, and GlobalSign, can lawfully issue a valid certificate for the domain if asked. Combined with a DNS misconfiguration, an expired domain-validation check, or a compromised internal system, that's a real mis-issuance path — and Certificate Transparency logs are typically the only way anyone notices after the fact.

CAA records are also one of the least readable DNS record types to inspect directly: many DNS-over-HTTPS APIs return them in RFC 3597 generic-record wire format — a raw hex string like \# 15 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67 — instead of a parsed 0 issue "pki.goog" tag. The DNS Inspector decodes this automatically, listing every authorized CA by tag and value, and gives a plain Restricted/Unrestricted verdict for any domain you scan.