dotvitals

CAA Record Generator

Build a correct CAA record naming the certificate authorities allowed to issue TLS certificates for your domain.

A certificate authority walks up from the name on the request until it finds a CAA record, so one on the bare domain covers everything beneath it. Put it on a subdomain instead and the rest of your names stay unprotected.

About the caa record generator

A CAA record restricts which certificate authorities are allowed to issue TLS certificates for a domain, and every publicly trusted CA is required to check it before issuing. This generator lets you pick the CA or CAs you actually use from a list of common providers, or enter a custom CA identifier, and builds the resulting record. It separates the issue property, which authorizes regular certificates for the exact hostname, from issuewild, which separately authorizes wildcard certificates, since a domain can grant one without the other, and many domains that never issue wildcards choose to explicitly disallow them with issuewild ";".

If your certificates are issued automatically by a CDN or hosting platform, such as through their own managed TLS, the generator prompts you to confirm which CA that platform actually uses under the hood, since omitting it from the record is a common cause of renewal failures that only surface weeks or months later. It also offers to add an iodef contact address, so any CA that receives an issuance request violating your policy has somewhere to report it, giving you an early warning of an attempted unauthorized certificate issuance rather than only finding out after the fact.

Testing the generated record with a CAA checker before considering the change final is worth the extra step, since a CAA record that accidentally omits a CA you rely on will not cause an immediate outage but will quietly block the next certificate renewal weeks or months later. Because that kind of failure surfaces weeks later at the next renewal rather than immediately, catching it at publish time with a quick checker run is considerably cheaper than discovering it once a certificate has already expired.

Common questions

Which CAs are supported?
Common publicly trusted CAs such as Let's Encrypt, DigiCert, Sectigo and Google Trust Services are included by name, plus a custom option for any CA not listed.
Should I include issuewild?
Include it for every CA you use for wildcard certificates. If you never issue wildcards, you can explicitly disallow them with issuewild ";", which the generator offers as an option.
What if my CDN handles certificates for me?
Check which CA the CDN or hosting platform uses under the hood and include it, since omitting it will cause future automatic renewals through that platform to fail.
Is the iodef property required?
No, it is optional. It only gives CAs an address to report a violating issuance request to, which is useful for awareness but not required for CAA itself to function.