Skip to content

dns caa

Jump to bottom
Springcomp edited this page Feb 8, 2026 · 2 revisions

Overview

From Wikipedia https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization

DNS Certification Authority Authorization (CAA) is an Internet security policy mechanism that allows domain name holders to indicate to certificate authorities whether they are authorized to issue digital certificates for a particular domain name.

Certificate Authority Authorization is a step you can take to restrict the list of certificate authorities that are allowed to issue certificates for your domains.

DNS configuration

Use SSLMate’s CAA Record Generator to create a CAA record with the following configuration:

  • flags: 0
  • tag: issue
  • value: "letsencrypt.org"

To verify if the DNS works, the following command:

dig @1.1.1.1 mydomain.com caa

should return:

mydomain.com. 3600 IN CAA 0 issue "letsencrypt.org"

Warning: setting up a CAA record will restrict which certificate authority can successfully issue SSL certificates for your domain. This will prevent certificate issuance from Let’s Encrypt staging servers. You may want to differ this DNS record until after SSL certificates are successfully issued for your domain.

Clone this wiki locally