CAA (Certification Authority Authorization) is a DNS record that allows domain owners to specify which Certificate Authorities are permitted to issue SSL/TLS certificates for their domain. It helps prevent unauthorized certificate issuance.

CAA records reduce the risk of mis-issuance and improve security by restricting certificate issuance to trusted CAs. They are also recommended by industry standards and required by some compliance frameworks.

Log into your DNS provider's management console (e.g., Cloudflare, AWS Route53, GoDaddy). Create a new DNS record of type CAA. Fill in the flag (usually 0), tag (issue/issuewild/iodef), and value (CA identifier or reporting URL). Paste the generated record from this tool.

• Let's Encrypt: letsencrypt.org
• DigiCert: digicert.com
• Sectigo (formerly Comodo): sectigo.com
• Amazon Trust Services: amazontrust.com
• Google Trust Services: pki.goog
• GlobalSign: globalsign.com
• Buypass: buypass.no

You can also use any other CA's specific domain by typing it manually.

The flag is an 8-bit unsigned integer (0-255) defined by RFC 6844. A flag of 0 means the record is not critical. Flag 1 (critical) means the CA must understand and respect the property tag; otherwise issuance is refused. Most configurations use flag 0.

Yes! You can set multiple CAA records, each authorizing a different CA or covering different tags (issue, issuewild, iodef). This is commonly done to allow more than one CA or to specify a reporting address.

Use the command dig CAA example.com (Linux/macOS) or online CAA lookup tools. CAs also check CAA records before issuance, so misconfigurations may cause certificate request failures.