DNS CAA Record Builder
Prevent unauthorized or fraudulent SSL/TLS certificates from being issued for your domain. Explicitly whitelist permitted Certificate Authorities (Let's Encrypt, Cloudflare, AWS ACM, DigiCert) via DNS CAA records.
; DNS Certification Authority Authorization (CAA) Zone Records (RFC 8659) ; Domain: example.com example.com. 3600 IN CAA 0 issue "letsencrypt.org" example.com. 3600 IN CAA 0 issue "pki.goog" ; Wildcard Certificate Issuance Permissions (*.example.com) example.com. 3600 IN CAA 0 issuewild "letsencrypt.org" ; Policy Violation Reporting (IODEF RFC 8659 §4.1.3) example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"
How DNS CAA Records Stop Rogue Certificate Issuance
By default, any of the 100+ publicly trusted Root Certificate Authorities worldwide can issue a valid TLS certificate for your domain if an attacker compromises a subdomain or BGP route. Since September 2017, the CA/Browser Forum mandates that every CA query DNS CAA records before signing any certificate.
Tree-Climbing DNS Lookup
Under RFC 8659 §3, if a subdomain (e.g., api.sub.example.com) lacks an explicit CAA record, the CA climbs the DNS hierarchy up to the apex domain (example.com) and enforces the parent policy.
Cloudflare Universal SSL
When using Cloudflare Universal SSL alongside restrictive CAA records, you must include letsencrypt.org, pki.goog, and ssl.com, or automatic edge certificate renewal will fail with a CAA validation error.
issue vs issuewild Precedence
If at least one issuewild property is present in the zone, CAs ignore all standard issue tags when evaluating wildcard requests (*.domain.com). Use issuewild ";" to completely forbid wildcard certificates.