CAA

networkingsecurity

Stands for: Certification Authority Authorization record

A DNS record declaring which certificate authorities may issue for a domain.

A Certification Authority Authorization record (RFC 8659) lets a domain owner restrict which CAs are allowed to issue certificates for the domain, a check CAs must honor before issuance.

A CAA record states which certificate authorities are permitted to issue for a domain. It does not prevent a compromised or coerced authority from issuing anyway; it obliges a compliant one to check and refuse, and it makes an unauthorized issuance a documented violation rather than an ambiguity.

Its value is therefore preventive at the policy layer rather than at the cryptographic one, which is worth stating plainly because it is easy to overestimate. It pairs with certificate transparency, where CAA reduces the chance of a mis-issuance and transparency logs make one detectable after the fact. Publishing one costs a single DNS record, and the common mistake is forgetting it when adding a new provider, which produces an issuance failure that looks like a problem with the certificate authority.

Also known as: caa, CAA record

← All glossary entries