What is a CAA record?

CAA (Certificate Authority Authorisation) records are DNS (Domain Name System) resource records that specify which certificate authorities (CAs) are authorised to issue SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificates for a specific domain. These records help domain owners maintain control over the issuance of SSL/TLS certificates for their domains and enhance security by preventing unauthorised CAs from issuing certificates.

How can I add a CAA record?

To add a CAA record, you’ll need to:

1. Locate your hosting package or domain name
2. Select Options
3. Select Manage
4. Go to Manage DNS, under Domain Names

From here, you should be able to select a CAA record type to add.

Here’s how CAA records work:

Domain Owner’s Control: When you own a domain and want to control which CAs can issue SSL/TLS certificates for that domain, you can create CAA records in your domain’s DNS settings.

CAA Record Format: A CAA record typically consists of the following components:

• Flag: A flag that specifies the meaning of the record.
• Tag: A tag that indicates the property or issue for which the record is being created.
• Value: The value associated with the tag, which specifies the CA(s) that are authorised to issue certificates for the domain.

Flag Values:

• “0” indicates that the CA specified in the CAA record is the only one authorised to issue certificates.
• “128” indicates that the CA specified in the CAA record is authorised, but other CAs are not prevented from issuing certificates.

Tag Values:

• “issue” is the most commonly used tag, which specifies the CAs that are allowed to issue certificates for the domain.
• Other tags, like “iodef” (for incident reporting) and “issuewild” (for wildcard certificates), can be used for specific purposes.

Here’s an example of a CAA record:

example.com.  CAA  0  issue "ca.example.net"

In this example:

• The domain is “example.com.”
• The flag is set to “0,” indicating that only the CA specified in the “issue” tag is authorised to issue certificates for the domain.
• The “issue” tag specifies “ca.example.net” as the authorised CA.

With this CAA record in place, only the CA “ca.example.net” is allowed to issue SSL/TLS certificates for “example.com.” If another CA attempts to issue a certificate for this domain, it should check the CAA records and honour the restrictions specified in them.

CAA records are a useful security mechanism to prevent unauthorised certificate issuance and enhance the overall security of websites and online services. Domain owners can configure these records to specify their preferred CAs and minimise the risk of certificate-related security issues.