Add a CAA record that names your certificate authority
Why it matters
A CAA record lists which certificate authorities may issue certificates for your domain, so a wrongly issued certificate is harder to obtain. Without one, any authority may issue.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Before you add anything, list every CA that issues certificates for the domain and its subdomains. Check your hosting or CDN platform, your ACME clients, any purchased certificates, and certificate transparency logs (the crt.sh site lists issuers per domain).
- Add one issue record for each CA, using the CA's identifier from its documentation. A missing CA will fail at its next issuance or renewal, which can be weeks later.
- Optionally add an issuewild record to control wildcard certificates, and an iodef record with an address that receives reports.
- Check with the command below, and run a renewal dry-run on every ACME client.
- CAA is looked up on the name and then its parents, and a CAA record on a subdomain overrides the one above it.
- Platforms need their own CAs. Vercel and Netlify issue through Let's Encrypt. Cloudflare Universal SSL uses several CAs. Shopify issues certificates through several CAs, so check Shopify's current help before adding CAA to a Shopify-connected domain.
dns
; one record per CA you use, flags 0 example.com. 3600 IN CAA 0 issue "letsencrypt.org" ; other common identifiers: ; Google Trust Services pki.goog ; DigiCert digicert.com ; Sectigo sectigo.com ; SSL.com ssl.com ; GlobalSign globalsign.com ; Amazon (ACM) amazon.com ; optional: forbid ALL wildcard certificates (skip if any *.example.com certificate exists, e.g. Cloudflare Universal SSL) ; example.com. 3600 IN CAA 0 issuewild ";" ; optional: an address that receives reports ; example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.