CAA Record Generator
Build valid CAA (Certificate Authority Authorization) records for your domain. Select which CAs are allowed to issue certificates, configure wildcard policy, and set up violation reporting.
Select the CAs permitted to issue standard (non-wildcard) certificates for your domain.
Control which CAs can issue wildcard certificates (e.g. *.yourdomain.com)
Optional. Gives CAs an address to report a certificate request that breaks these records. RFC 8659 does not require CAs to send reports, so an empty mailbox does not mean nobody tried. Reports arrive as IODEF, an XML incident format, so use a mailbox a person reads. Do not use your DMARC reporting address: ShieldMarc's does not read IODEF reports.
Summary
Your CAA records
Add each as a separate CAA record. Use @ as the name for your root domain. DNS hosts that ask for the flags, tag and value separately, such as Cloudflare, take the value. Hosts that take one line per record, such as Route 53 and Google Cloud DNS, take the whole record.
issue (Cloudflare lists it as “Only allow specific hostnames”)CA domain nameletsencrypt.orgMeansletsencrypt.org may issue certificates.Record0 issue "letsencrypt.org"All 1 record as zone-file lines
@ IN CAA 0 issue "letsencrypt.org"
Verify your new CAA records
After adding these records to your DNS, use our CAA Checker to confirm they are published correctly. ShieldMarc's CAA monitor then rechecks them and emails you if they disappear. It is part of Professional and MSP, and a new account gets 30 days of it free, no card.
Start free trialWhat Are CAA Records?
CAA (Certificate Authority Authorization) is a DNS record type defined in RFC 8659. It lets domain owners declare which Certificate Authorities are permitted to issue SSL/TLS certificates for their domain. Before issuing a certificate, compliant CAs must check your CAA records and refuse issuance if they are not listed.
Why You Should Publish CAA Records
- Prevent unauthorised certificates: Without CAA, any of the hundreds of publicly trusted CAs can issue a certificate for your domain. CAA restricts this to only the CAs you actually use.
- Reduce attack surface: If an attacker compromises a CA you do not use, CAA prevents them from issuing certificates for your domain through that CA.
- Ask CAs to report refused requests: The
iodeftag gives CAs an address for reporting a certificate request that breaks your policy. RFC 8659 does not require CAs to send these IODEF reports, so do not rely on them as your only warning.
Neither Cyber Essentials nor Cyber Essentials Plus requires CAA. The scheme's requirements for IT infrastructure (NCSC, v3.3, April 2026) cover five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. DNS records such as CAA are not among them.
CAA Record Format
Each CAA record has three parts:
- Flags (0): Almost always 0. A value of 128 sets the "critical" flag, meaning CAs must refuse issuance if they do not understand the tag.
- Tag: One of
issue,issuewild, oriodef. - Value: The CA domain name (for issue/issuewild) or a reporting URL (for iodef).
How to Add CAA Records
- Use the generator above to build your records.
- Log in to your DNS provider (Cloudflare, Route 53, GoDaddy, etc.).
- For each generated line, create a new CAA record at the root of your domain (or on the specific subdomain you want to protect).
- Use our CAA Checker to verify the records are published correctly.
Frequently Asked Questions
Will adding CAA records break my existing certificates?
No. CAA records only affect future certificate issuance. Your current certificates will continue to work until they expire. Just make sure your current CA is included in your CAA records before your next renewal date.
What if I use Cloudflare or another CDN that issues certificates?
Your CAA records must allow the CAs your CDN uses, and with Cloudflare that depends on how it is set up. When Cloudflare runs your DNS, it adds records for its own certificate authorities at the zone apex once the apex has any CAA record, while Universal SSL is on, so you do not need to add those there. If Universal SSL is off, allow the CA of your advanced certificate (letsencrypt.org, pki.goog or ssl.com).
Cloudflare adds nothing to a name below the apex that has CAA records of its own, to a CNAME setup, to Cloudflare for SaaS or to a subdomain zone whose parent is hosted elsewhere. There, if Cloudflare manages your certificate, allow Let's Encrypt (letsencrypt.org), Google Trust Services (pki.goog) and SSL.com (ssl.com), the CAs Cloudflare issues from. If you upload your own certificate to Cloudflare, allow the CA that issues it instead. For any other CDN, check its documentation for the CAs it uses.
What happens if my CA is not in the CAA record?
The CA must refuse to issue the certificate. This means your next certificate renewal will fail. You will need to either add the CA to your CAA record or switch to a CA that is already listed. Your existing certificate continues to work in the meantime.
Do I need separate issuewild records?
Only if you want to restrict wildcard certificates differently from standard certificates. If you omit issuewild, the CAs listed in your issue records are also permitted to issue wildcards. If you want to block all wildcard issuance, add 0 issuewild ";".
What email should I use for iodef reporting?
A mailbox a person reads, such as caa-reports@example.com. Reports arrive as IODEF, an XML incident format. Do not reuse your DMARC reporting address (rua=): ShieldMarc's does not read IODEF reports. RFC 8659 does not require CAs to send reports, so an empty mailbox does not mean nobody tried.
Does CAA affect my Security Grade?
Yes. CAA is a check in the Security Grade framework. Passing it counts towards a strong Security Grade.
Do subdomains inherit CAA records?
Yes. If a subdomain does not have its own CAA record, CAs walk up the domain tree until they find one. A CAA record on example.com applies to all subdomains unless they publish their own CAA records.
Want the full picture?
Our Security Grade checks CAA alongside DMARC, SPF, DNSSEC, MTA-STS, SSL, and domain registration in one scan.