Sign inMonitor a domain
CAA · type 257

Says which certificate authorities may issue for the domain.

Last updated 5 Oct 2026 from the IANA RR TYPE registry

Short answer

CAA records list the certificate authorities allowed to issue TLS certificates for a name. Public CAs must check them before issuing; a CA that isn’t listed must refuse. issue covers ordinary certificates, issuewild wildcards, and iodef is where CAs can report refused requests.

Type
CAA
Code
257
Defined in
RFC 8659
IANA description
Certification Authority Restriction
Field: Flags
0, or 128 for “critical”
Field: Tag
issue, issuewild or iodef
Field: Value
CA domain, or ";" for none

How it works

A CA looks for CAA at the exact name and then climbs towards the root, so a record at example.com also covers www.example.com unless the subdomain has its own. With no CAA anywhere up the tree, any public CA may issue.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Example uses reserved documentation names and addresses (RFC 2606, RFC 5737, RFC 3849).

Common mistakes

  • Adding CAA for one CA and then renewing through a CDN that uses another.
  • issuewild without issue, which still leaves ordinary certificates open to any CA.

How to check yours

Before adding CAA, check which authorities actually issue your certificates today: your web host, CDN and any email or SaaS provider that serves pages on your domain may each use a different one. List all of them, or renewals will start failing when a provider’s CA checks the record and finds itself missing.

Related record types

TXTFree-form text; carries SPF, DMARC, DKIM keys and ownership tokens.DSThe parent zone’s fingerprint of a signed child’s key (DNSSEC).

Sources

Sources

  1. IANA: Resource Record (RR) TYPEs registry · checked 5 Oct 2026
  2. RFC 8659 · checked 5 Oct 2026