What does a CAA record actually prevent?

It stops publicly trusted certificate authorities other than the ones you list from issuing a certificate for your name. It is a check the CA is required to perform, so it blocks mis-issuance rather than filtering traffic.

Do I need a CAA record on every subdomain?

No. A CA walks up the tree from the name being issued until it finds a CAA record set, so one record at the apex covers everything below it unless a subdomain publishes its own.

What does the critical flag of 128 do?

It tells a CA that if it does not understand the tag, it must refuse to issue rather than ignore it. That is useful for future tags but risky today — leave it at 0 unless you specifically want issuance to fail on unknown properties.

How do I forbid all certificate issuance for a domain?

Publish a single issue record with a value of ";" — a semicolon and nothing else. That is the standard way to say no certificate authority may issue for this name, useful on domains that never serve HTTPS.

How long does a CAA change take to apply?

As long as the record's TTL plus whatever the CA caches, which is typically minutes rather than hours. Publish the new CA before switching, wait for the TTL to pass, then remove the old one.

CAA Record Generator

Build the DNS record that names the only certificate authorities allowed to issue for your domain, and decode the one you already publish.

The CAA Record Generator builds records in your browser. Your domain names and contact addresses are never uploaded.

Open the DMARC Record Generator

About CAA Record Generator

A CAA record is a short whitelist of the certificate authorities allowed to issue certificates for your domain. Every publicly trusted CA is required to check it before signing, which turns a single DNS record into a hard stop against an attacker who controls a stray subdomain, an abandoned email alias or a forgotten hosting panel. The record has three parts — flags, a tag and a quoted value — and the two mistakes that break issuance are publishing a URL where a bare domain belongs and setting the critical flag on a tag the CA does not understand. This generator builds the record for the CAs you actually use, validates it, and prints both zone-file lines and the fields a dashboard asks for.

Features

One-click values for Let's Encrypt, DigiCert, Sectigo, Google Trust Services and more
issue, issuewild and iodef tags with the correct flag handling
CA parameters such as accounturi and validationmethods
Validation that catches URLs, bad iodef values and empty tags
Zone file lines and dashboard fields side by side
Decode mode that explains an existing record in plain English
A dig command to verify what was actually published
Records are built entirely in your browser

How to use the CAA Record Generator

Enter the domain the record belongs to
Add the certificate authorities you allow to issue
Add an iodef address if you want to be told about blocked attempts
Copy the zone lines or dashboard fields into your DNS provider

Example

Input

example.com, allow Let's Encrypt, report to security@example.com

Output

example.com.	3600	IN	CAA	0 issue "letsencrypt.org"
example.com.	3600	IN	CAA	0 iodef "mailto:security@example.com"

Without an issuewild tag, wildcard requests fall back to the issue list.

Common errors & troubleshooting

Certificate issuance started failing after publishing the record. — The CA you use is probably not on the list, or its identifier is spelled differently from its brand name — ZeroSSL certificates are issued under sectigo.com, for example. Check the CA's own documentation for the exact string.
Wildcard certificates are refused while normal ones work. — An issuewild tag overrides issue for wildcards. If you publish issuewild at all, it must list every CA allowed to sign a wildcard; if you do not need different rules, leave issuewild out entirely.
The value was rejected as invalid by the DNS provider. — CAA issue values are bare domain names, not URLs. Drop the https:// prefix and any trailing path — letsencrypt.org, not https://letsencrypt.org/.

Frequently asked questions

What does a CAA record actually prevent?: It stops publicly trusted certificate authorities other than the ones you list from issuing a certificate for your name. It is a check the CA is required to perform, so it blocks mis-issuance rather than filtering traffic.
Do I need a CAA record on every subdomain?: No. A CA walks up the tree from the name being issued until it finds a CAA record set, so one record at the apex covers everything below it unless a subdomain publishes its own.
What does the critical flag of 128 do?: It tells a CA that if it does not understand the tag, it must refuse to issue rather than ignore it. That is useful for future tags but risky today — leave it at 0 unless you specifically want issuance to fail on unknown properties.
How do I forbid all certificate issuance for a domain?: Publish a single issue record with a value of ";" — a semicolon and nothing else. That is the standard way to say no certificate authority may issue for this name, useful on domains that never serve HTTPS.
How long does a CAA change take to apply?: As long as the record's TTL plus whatever the CA caches, which is typically minutes rather than hours. Publish the new CA before switching, wait for the TTL to pass, then remove the old one.

Related tools

SPF Record Generator — Build and validate the SPF TXT record that stops others sending mail as your domain.
DKIM Record Generator — Build and inspect the DKIM TXT record that publishes your mail signing key.
DMARC Record Generator — Build and validate a DMARC DNS TXT record with policy, reporting and alignment.
Reverse DNS Generator — Turn IPs and prefixes into PTR names, zone files and RFC 2317 delegations.
SRV Record Generator — Build and decode SRV records for SIP, XMPP, Minecraft, LDAP and Autodiscover.
CIDR / Subnet Calculator — Calculate network, broadcast, host range and mask from a CIDR block.