Skip to content

CAA Record Builder

Create CAA DNS records that limit which certificate authorities may issue for your domain, including wildcards and reporting.

A CAA record is a short DNS entry that names the certificate authorities allowed to issue certificates for your domain. Every public CA must check it before issuing, so a stolen DNS validation or a careless vendor can't get a certificate from some other CA in your name. Pick the CAs you actually use (the CT search shows which ones issue for you today), choose a wildcard policy, and add the records at your DNS provider.

Domain

Who may issue certificates

Wildcard certificates (*.example.com)

Report refused requests to (optional)
Adds an iodef record so CAs can tell you about blocked requests.
Applies to example.com and every subdomain without its own CAA records. Check services that issue certificates for you (CDNs like Cloudflare, Microsoft 365, website builders, email providers) are included, or their renewals will fail.

Records to add

NameTypeFlagsTagValue
@ (example.com)CAA0issueletsencrypt.org

Zone file (BIND) format

example.com.	3600	IN	CAA	0 issue "letsencrypt.org"

After adding them, check with CAA Lookup and see who issues for you today with Certificate Transparency Search.