What Is a CAA DNS Record and Why It Matters for SSL

A CAA (Certification Authority Authorization) record specifies exactly which certificate authorities are permitted to issue SSL certificates for your domain.

Why It Matters

Without a CAA record, technically any recognized CA could issue a certificate for your domain if they were ever tricked or compromised — a CAA record explicitly narrows that down to only the CAs you actually use.

Setting One Up

Add a CAA TXT-style record to your domain's DNS specifying your chosen CA (like Let's Encrypt), and any request from an unauthorized CA will be rejected by design.

Further Reading

• SSL Certificates
• More Cybersecurity Guides
• Let's Encrypt