What is CAA record?

A DNS record that lists which certificate authorities may issue certificates for a domain.

CAA records (for example 0 issue "letsencrypt.org") stop unauthorized authorities from issuing certificates. Public CAs must check CAA before issuing.

Related terms

• SOA record: The Start of Authority record with a zone's primary server, admin contact and timers.
• TTL (time to live): How long, in seconds, resolvers may cache a DNS answer.
• DNSSEC: Cryptographic signatures that let resolvers verify DNS answers weren't tampered with.