Certification Authority Restriction
Quick facts
Purpose
Certification Authority Restriction
CAA is one of the DNS resource record (RR) types defined by RFC 8659.
Example
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Related record types
Common uses
Format
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
| Field | Explanation |
|---|---|
| Flags | 0 = normal, 128 = critical. |
| Tag | issue / issuewild / iodef. |
| Value | Authorized CA or reporting URL. |
Common services
Frequently asked questions
Restrict certificate issuers, CA authorization policy
In the DNS management panel of your registrar or DNS provider (for example Cloudflare or Route53).
Sources & standards
Updated 2026-08-18
Explore this reference