CAA Record Generator
Generate CAA records that allow only your certificate authorities, such as Let's Encrypt, Google Trust Services, Sectigo, DigiCert or AWS, to issue certificates for your domain.
Free · No sign-up · Your inputs stay in your browser
Input
Generate CAA records
Output
Zone file
109 characters
| Flag | Tag | Value |
|---|---|---|
| 0 | issue | letsencrypt.org |
| 0 | iodef | mailto:[email protected] |
Before issuing, every public CA must check CAA and refuse if it is not listed (RFC 8659, mandatory since 2017). The check climbs the tree, so records on example.com also cover www.example.com unless a subdomain has its own. An issue value of a lone semicolon forbids every certificate. Forgetting the CA your CDN or load balancer uses is the usual way to break renewal.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Why publish CAA
Every public CA must check CAA records before issuing and refuse if it is not listed (RFC 8659, mandatory since September 2017). CAA limits which companies a mis-issuance attack or a hijacked validation could come through, at the cost of one DNS record.
Don't lock yourself out
Before publishing, list every CA that issues for the domain: your own ACME client's, your CDN's (Cloudflare uses several), your load balancer's and any SaaS that serves on a subdomain. Records on the parent domain apply to all subdomains that have none of their own, so a missing CA shows up as a failed renewal somewhere unexpected.