CAA Implementation

CAA Record Structure

CAA records consist of three parts: flags, tag, and value. The most common tags are:

• issue: Authorizes a CA to issue certificates for the domain
• issuewild: Authorizes a CA to issue wildcard certificates for the domain
• iodef: Specifies a URL for reporting certificate issuance violations

example.com. CAA 0 issue "letsencrypt.org"
; Flags=0 (non-critical), Tag=issue (certificate authorization), Value=CA identifier

example.com. CAA 0 issuewild ";"
; Flags=0 (non-critical), Tag=issuewild (wildcard control), Value=empty (prohibits all)

example.com. CAA 0 iodef "mailto:admin@example.com"
; Flags=0 (non-critical), Tag=iodef (incident reporting), Value=notification destination

Recommended Implementation Practices

Start by specifying authorized Certificate Authorities using issue tags that clearly identify which CAs can issue certificates for your domain. Use separate issuewild tags for wildcard certificate control, as wildcard certificates pose additional security risks and should be more tightly controlled than regular certificates.

Include iodef tags for violation reporting to ensure you receive notifications when unauthorized certificate issuance attempts occur. This early warning system helps you detect potential attacks or misconfigurations quickly. Use well-known CA identifiers from established certificate authorities to ensure broad compatibility and recognition.

Regularly review and update CAA records as part of your security maintenance procedures, especially when changing certificate providers or adding new services. Test CAA records after implementation using DNS query tools and online validators to confirm they work correctly before relying on them for protection.

Practices to Avoid

Avoid using empty values in CAA records without a specific security purpose, as this can prevent legitimate certificate issuance when you actually need it. Never authorize unknown or untrusted Certificate Authorities, as this defeats the purpose of CAA protection by allowing potentially compromised or malicious CAs to issue certificates for your domain.

Don't forget to update CAA records when changing certificate providers, as outdated CAA records can block legitimate certificate renewal and cause service outages. Ensure you use correct CA domain identifiers rather than guessing or using outdated information, as incorrect identifiers render CAA records ineffective.

Never ignore CAA violation reports, as these may indicate attempted attacks or misconfigurations that need immediate attention. Avoid implementing CAA without monitoring certificate issuance, as CAA alone doesn't prevent unauthorized certificates—it only provides a mechanism for detection and prevention when properly monitored.

Basic CAA Configuration

# CAA record format: domain TTL IN CAA flags tag "value"
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
; TTL=3600 (1 hour): Cache time for CAA record updates
; flags=0 (non-critical): CA can ignore if unsupported
; tag=issue: Controls regular certificate issuance authorization
; value="letsencrypt.org": Specific CA identifier string

# Prevent ALL wildcard certificate issuance
example.com. 3600 IN CAA 0 issuewild ";"
; flags=0 (non-critical): Standard flag for wildcard control
; tag=issuewild: Controls wildcard (*.domain) certificate authorization
; value=";": Empty value explicitly prohibits ALL wildcard issuance

# Multiple CA authorization with different properties
example.com. 3600 IN CAA 0 issue "digicert.com; account=123456"
; Properties: account=123456 specifies DigiCert account ID for validation

example.com. 3600 IN CAA 128 issue "sectigo.com"
; flags=128 (critical): CA MUST understand and process this record

# Violation reporting for unauthorized certificate attempts
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"
; tag=iodef: Incident Object Description Exchange Format (RFC 5070)
; value="mailto:": Email destination for CAA violation reports

example.com. 3600 IN CAA 0 iodef "https://example.com/caa-report"
; Alternative: HTTPS URL for automated violation report processing

Multiple CA Authorization

# Multiple CA authorization for redundancy and flexibility
example.com. 3600 IN CAA 0 issue "letsencrypt.org"   ; Free automated certificates
example.com. 3600 IN CAA 0 issue "digicert.com"      ; Enterprise/EV certificates
example.com. 3600 IN CAA 0 issue "sectigo.com"       ; Commercial certificates
; Multiple issue tags = logical OR (any authorized CA can issue)

# Wildcard control (more restrictive than regular certificates)
example.com. 3600 IN CAA 0 issuewild "digicert.com"
; issuewild overrides issue tag for wildcard requests (*.example.com)
; Wildcards require higher trust level - limit to premium CAs

# Account-specific restrictions (optional enhanced security)
example.com. 3600 IN CAA 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/123456"
; Restrict to specific CA account (prevents unauthorized issuance even with valid CA)

DNS Query Tools

# Check CAA records using dig
dig CAA example.com

# Alternative query using record type number
dig TYPE257 example.com

Online CAA Checkers

• DNSAudit.io CAA Implementation Analysis
• SSLmate CAA Record Helper
• Qualys SSL Labs Server Test
• Certificate Authority websites often provide CAA validation tools

Complementary Security Technologies

Certificate Transparency monitoring provides visibility into all certificates issued for your domain by requiring Certificate Authorities to log certificates in publicly auditable logs. This allows you to detect unauthorized certificates even if CAA controls are bypassed or misconfigured.

HTTP Public Key Pinning (HPKP) allows you to specify which specific public keys are valid for your domain, providing an additional layer of protection beyond CAA. DNS-based Authentication of Named Entities (DANE) uses DNS to specify which certificates or certificate authorities are authorized for your domain, complementing CAA records with additional cryptographic validation.

These technologies work together to create defense in depth—if one protection mechanism fails or is bypassed, others continue providing security coverage for your certificate infrastructure.

Certificate Monitoring Tools

Certificate Transparency logs provide the foundation for monitoring all certificates issued for your domain. These cryptographically-assured logs contain records of every certificate issued by participating Certificate Authorities, making unauthorized issuance detectable through regular monitoring.

Tools like crt.sh certificate search allow you to query Certificate Transparency logs to find all certificates issued for your domain, helping you identify unauthorized certificates quickly. Google Certificate Transparency and Facebook Certificate Transparency Monitor provide automated alerting when new certificates are discovered for your monitored domains.

Regular monitoring using these tools ensures you can detect and respond to unauthorized certificate issuance attempts, even if they bypass CAA controls through compromised Certificate Authorities or other attack vectors.