DNS
CAA record generator
Build a CAA record that names exactly the certificate authorities allowed to issue for a domain, wildcards and all.
Free, no accountIn your browser
Only used to label the "At" line below - the records below work for any domain.
Not on the list above? Type the issuer domain your CA publishes.
An email address or an https URL a CA should notify when a request it refuses looks like it was not yours.
Result
No CAA records to publish yet
Tick a certificate authority above to build a record.
- Warning
Nothing chosen: there is no record to publish
With no certificate authority picked, there is nothing below to paste - and publishing nothing is itself a decision, not an empty form: any publicly trusted CA remains free to issue for this name, the same as before a CAA record existed at all.
Tick at least one certificate authority above to generate a record that actually restricts issuance.
- The six issuer domains offered above are the ones each CA commonly publishes, not a guarantee for every account with that CA - confirm the exact domain with your own CA before publishing it.
What this is
This caa record generator turns a short list of certificate authorities into the exact CAA lines RFC 8659 defines for them, so a domain stops trusting every publicly trusted CA on earth and starts trusting only the ones it actually uses.
A CAA record restricts, by its issue tag, which certificate authorities are allowed to issue a certificate for a name at all; issuewild does the same job for wildcard certificates specifically, and iodef names an address a CA should write to when it turns a request down. Leaving the whole record out is not neutral in the way it feels - it is the single choice of trusting every CA that exists, which is exactly what this generator exists to narrow.
For how CAA fits alongside the other records a domain needs, see our blog guide "The DNS records a domain needs, and what each one actually does."
How to read the result
There are, in effect, two different ways a domain ends up unprotected, and this tool draws the line between them in its own words rather than the checker's. Publish nothing, and you have made no choice at all - any CA anywhere may issue, which is simply how the web has always defaulted. Publish a record naming only one CA, and you have made a choice that is too narrow the moment a host, a CDN or a renewal job quietly switches to a second CA behind your back: that CA now gets refused outright, not slowly, because it was never named.
Tick every CA that might ever issue a certificate for this name - including one your host might switch to automatically on renewal - before trusting a single-CA list to be safe. The records below are generated from exactly what is ticked; nothing is assumed on your behalf.
Common mistakes
What goes wrong most often, and how to tell.
- Naming only the CA used todayA host, a CDN or a load balancer in front of a domain can renew through a different certificate authority than the one that issued the first certificate, often without telling you. A CAA record naming only the original CA refuses the renewal outright.
- Treating an empty generator as a safe defaultLeaving every box unticked does not produce a cautious, restrictive record - it produces no record at all, which authorizes every publicly trusted CA on earth rather than none of them.
- Typing a CA name instead of its issuer domainThe issue tag's value has to be the exact domain a CA publishes for this purpose, not its brand name or website - "Sectigo" in the value field authorizes nothing, because no certificate authority identifies itself that way in a CAA record.
Questions
What people ask about this tool.
- None at all. An empty selection generates no CAA record, which is not the same as a restrictive one - it leaves every publicly trusted certificate authority free to issue for the domain, exactly as if CAA had never been set up.
- It is worth doing if a host, a load balancer or a CDN sits in front of the domain and might renew through a different CA on its own schedule - a CAA record naming only today's CA refuses that renewal the moment it happens, often with no warning beforehand.
- Blocking wildcards publishes an issuewild record with the value ";", which forbids every CA from issuing a wildcard certificate even if the issue tags above still allow it to issue an ordinary one. Saying nothing omits that tag entirely, so wildcard authorization simply follows whatever the issue tags already say.
- RFC 8659's iodef tag only accepts a mailto email address or an https:// URL - anything else is not a reporting address a certificate authority can act on, so this tool leaves it out of the generated record rather than publish something no CA will actually use.
Sources
Every fixed value here comes from the provider’s own documentation. These pages change, so each says the day it was last read.
- IETF, “RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record” read 13 October 2026
- Let's Encrypt, “Certificate Authority Authorization (CAA)” read 13 October 2026
Use it from the API
The same check, as one request.