DNS CAA records
type: TechArticle
description: A CAA record tells certificate authorities which of them are allowed to issue certificates for your domain. Cheap to add, blocks a class of mis-issuance attacks.
language: en
is part of: Web Specification Studio
author: Web Specification Studio
publisher: Web Specification Studio
license: https://creativecommons.org/licenses/by/4.0/
date modified: 2026-05-29T09:13:20.000Z
citation: RFC 8659 — DNS Certification Authority Authorization (CAA) Resource Record
  type: CreativeWork
  publisher: IETF
citation: Let's Encrypt — CAA
  type: CreativeWork
  publisher: Let's Encrypt
citation: RFC 8657 — CAA Record Extensions for Account URI and ACME Method Binding
  type: CreativeWork
  publisher: IETF

Web Specification Studio
type: WebSite

Web Specification Studio
type: Organization

breadcrumb
type: BreadcrumbList
item list element: Home
  type: ListItem
  position: 1
  item: https://webspecification.com/
item list element: Spec
  type: ListItem
  position: 2
  item: https://webspecification.com/spec/
item list element: Security
  type: ListItem
  position: 3
  item: https://webspecification.com/spec/security/
item list element: DNS CAA records
  type: ListItem
  position: 4
  item: https://webspecification.com/spec/security/caa-records/