🛡️
CAA Record Lookup
Certification Authority Authorization (CAA) specifies which Certificate Authorities (CAs) are allowed to issue SSL certificates for a domain.
RFC:
RFC 8659
TYPE:
Resource Record
TAG:
issue, issuewild, iodef
What is CAA Record Lookup?
CAA records heighten domain security by allowing domain owners to declare explicitly which Certificate Authorities are authorized to issue certificates for their domain, limiting the impact of compromised CAs.
How it Works
When a CA receives a request to issue a certificate for a domain, they are required by industry standards to query the CAA record. If the CAA record exists and does NOT list the requested CA, the CA must refuse to issue the certificate.
Key Use Cases
Preventing unauthorized issuance of SSL/TLS certificates.
Restricting wildcard certificate issuance independently of normal certificates.
Receiving reports of prohibited certificate requests via the iodef tag.
Advanced Details
Even if you only use one CA like Let's Encrypt, adding a CAA record enforcing them is a critical preventative measure against mis-issuance by entirely separate Certificate Authorities.
Cybersecurity Pros & Cons
Security Advantages
- Directly prevents rogue SSL certificate issuance — a common vector for MITM attacks against corporate users.
- The `iodef` tag sends instant alerts when unauthorized CA issuance attempts are detected.
- Restricting wildcard certs independently prevents catastrophic credential theft via `*.domain.com` abuse.
- Reduces the blast radius of a compromised Certificate Authority by limiting its scope to your domain.
Security Limitations
- CAA records only constrain compliant CAs — rogue or non-compliant CAs may still ignore the record.
- Misconfiguring CAA blocks can prevent legitimate certificate renewals, causing unplanned HTTPS outages.
- Does not protect against attacks on the CA itself; a breached allowed CA can still mis-issue.
- CAA records are not enforced retroactively on already-issued certificates already in the wild.
Ready to Test?
Use our professional-grade tool to perform a real-time check for this module.
Run Module Now