Перейти к содержанию
ipaddress.ae
CAA

What is a CAA record?

CAA records specify which certificate authorities may issue TLS certificates for a domain. Learn the issue, issuewild and iodef tags.

Этот текст пока недоступен на языке «русский». До публикации перевода он показан на языке «английский».

example.com.   3600   IN   CAA   0 issue "letsencrypt.org"

A CAA record (Certification Authority Authorization, RFC 8659) lists the certificate authorities allowed to issue TLS certificates for a domain. Every public CA must check CAA before issuing; if the records exist and the CA isn’t listed, it must refuse.

Tags

  • issue — CAs allowed to issue certificates for the name.
  • issuewild — CAs allowed to issue wildcard certificates.
  • iodef — where CAs should report rejected requests (mailto: or https:).

CAA is inherited: a record on example.com also covers www.example.com unless the subdomain has its own CAA records. No CAA records at all means any CA may issue.

Частые вопросы

Do I need a CAA record?
It's optional but recommended: it reduces the risk of a certificate being mis-issued by a CA you don't use.
Why did my certificate renewal fail after adding CAA?
The CA you use isn't listed. Add an issue tag with its identifier, e.g. letsencrypt.org.

Справочник по записям DNS