What is a CAA record and do I need one?

The gap it closes

There are dozens of trusted certificate authorities, and by default every one of them may issue a certificate for your domain. A mistake or a compromise at any single one produces a certificate that browsers accept as valid for your site.

This is not theoretical — there is a long history of mis-issuance incidents. CAA reduces the exposure from "any CA in the world" to "the ones you named".

What it looks like

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:security@example.com"

To forbid issuance entirely — useful for a domain that serves nothing:

example.com.  CAA  0 issue ";"

How it is evaluated

CAA is resolved by walking up the tree. Checking shop.example.com, a CA looks at that name, then example.com, and stops at the first record set it finds. A record at your apex therefore governs every subdomain automatically, and the absence of a record on a subdomain is normal rather than a fault.

Setting it up

1. List every CA you currently use — including your CDN, which may issue its own certificates on your behalf.
2. Add an issue record for each, and issuewild if you use wildcards.
3. Add an iodef address so you hear about violation attempts.
4. Verify with dig CAA example.com.
5. Record the change somewhere, because a future certificate purchase from a different CA will fail until the record is updated — and the error message is rarely obvious.

Common CA identifiers

Verify against your provider's current documentation before publishing; these identifiers do change, and a wrong one blocks renewals rather than protecting anything.