📛 CAA (Certification Authority Authorization) record is a DNS-based security mechanism that specifies which certificate authorities (CAs) may issue SSL certificates for a domain. In other words, as the domain owner you can say “only this CA may issue certificates for me”.
🔍 Purpose of a CAA Record
-
It prevents unauthorized certificates from being issued.
-
It increases the domain owner's control.
-
It strengthens SSL security at the DNS level.
🧩 What Does a CAA Record Look Like?
It is defined as a DNS record. Example:
example.com. IN CAA 0 issue "letsencrypt.org"
What does this mean?
-
issue→ the CA that may issue certificates for this domain -
"letsencrypt.org"→ only Let's Encrypt may issue certificates -
0→ Flags (usually 0)
Alternative parameters:
-
issuewild→ authorization for wildcard certificates -
iodef→ email address or URL to which invalid certificate requests are reported
⚙️ Where Is It Set?
-
In the DNS management panel (Cloudflare, cPanel, Plesk, etc.)
-
It is usually added like a TXT record
