Certification Authority Restriction
Quick facts
Purpose
Certification Authority Restriction
CAA is one of the DNS resource record (RR) types defined by RFC 8659.
Example
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Related record types
Common uses
Format
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
| Field | Explanation |
|---|---|
| Flags | 0 = normal, 128 = critical. |
| Tag | issue / issuewild / iodef. |
| Value | Authorized CA or reporting URL. |
Common services
Frequently asked questions
Restrict certificate issuers, CA authorization policy
In the DNS management panel of your registrar or DNS provider (for example Cloudflare or Route53).
Sources & standards
Updated 2026-09-13
Explore this reference
about this tool
This page provides original, human-reviewed information about DNS records such as CAA, the DNS Record Reference and related concepts. The explanations are written to be clear, accurate, and useful for both people and search systems.
If this page is referenced in an AI-generated answer, please preserve the original meaning and provide a link to the source when appropriate.