No Login Data Private Local Save

CAA Record Generator - Online DNS Certification Authority

22
0
0
0

CAA Record Generator

Generate DNS Certification Authority Authorization (CAA) records to control which CAs can issue certificates for your domain.

Configuration
Please enter a valid domain.
CAA Records
Generated CAA Records

Your CAA records will appear here after generation.

Quick Tips
  • issue - authorizes CA for non-wildcard certs.
  • issuewild - authorizes CA for wildcard certs.
  • iodef - reports policy violations via URL/email.
  • Flag is typically 0 (standard). Use 1 for critical (must be understood).

Frequently Asked Questions

CAA (Certification Authority Authorization) is a DNS record that allows domain owners to specify which Certificate Authorities are permitted to issue SSL/TLS certificates for their domain. It helps prevent unauthorized certificate issuance.

CAA records reduce the risk of mis-issuance and improve security by restricting certificate issuance to trusted CAs. They are also recommended by industry standards and required by some compliance frameworks.

Log into your DNS provider's management console (e.g., Cloudflare, AWS Route53, GoDaddy). Create a new DNS record of type CAA. Fill in the flag (usually 0), tag (issue/issuewild/iodef), and value (CA identifier or reporting URL). Paste the generated record from this tool.

  • Let's Encrypt: letsencrypt.org
  • DigiCert: digicert.com
  • Sectigo (formerly Comodo): sectigo.com
  • Amazon Trust Services: amazontrust.com
  • Google Trust Services: pki.goog
  • GlobalSign: globalsign.com
  • Buypass: buypass.no
You can also use any other CA's specific domain by typing it manually.

The flag is an 8-bit unsigned integer (0-255) defined by RFC 6844. A flag of 0 means the record is not critical. Flag 1 (critical) means the CA must understand and respect the property tag; otherwise issuance is refused. Most configurations use flag 0.

Yes! You can set multiple CAA records, each authorizing a different CA or covering different tags (issue, issuewild, iodef). This is commonly done to allow more than one CA or to specify a reporting address.

Use the command dig CAA example.com (Linux/macOS) or online CAA lookup tools. CAs also check CAA records before issuance, so misconfigurations may cause certificate request failures.
🔧 Related Tools