DNS CAA Record Generator & Policy Validator

DNS CAA Record Generator & Policy Validator

Generate RFC 8659 compliant Certification Authority Authorization (CAA) DNS records to restrict SSL/TLS certificate issuance, configure wildcard policies, and set up violation reporting.

Presets:
CAA Configuration & Parameters
Total Issuance Lockdown (Block All CAs)

Issues an empty record (issue ";") preventing any CA worldwide from issuing certificates for this domain.

Let's Encrypt(letsencrypt.org)
Directives: 2•Domain: example.com
Security Rating:Standard Protection
; ==============================================================================
; DNS CAA (Certification Authority Authorization) Resource Records
; Domain: example.com.
; RFC 8659 (obsoletes RFC 6844) / RFC 8657 (ACME Extensions)
; Generated 100% Client-Side with ToolsAA CAA Record Generator
; ==============================================================================

$ORIGIN example.com.
$TTL 3600

; Authorizes Let's Encrypt (letsencrypt.org) to issue standard certificates
example.com.             3600   IN  CAA  0  issue     "letsencrypt.org"

; Security contact for automated incident violation alerts via email
example.com.             3600   IN  CAA  0  iodef     "mailto:[email protected]"
Lines: 17•Bytes: 712 B
RFC 8659 Compliant
Authorized CAs
Let's Encrypt

Only designated issuers can sign valid SSL/TLS certificates.

Wildcard Policy
Inherits Standard

Hardened against rogue wildcard issuance and subdomain hijacking.

Incident Reporting
Active Alerting (iodef)

Automated notifications for unauthorized certificate attempts.

RFC 8659 Strict Issuance Control

Prevent rogue or unauthorized Certificate Authorities from misissuing SSL/TLS certificates for your apex domains and subdomains by explicitly white-listing trusted issuers.

Wildcard Segregation & Lockdown

Isolate wildcard certificate issuance using issuewild parameters, or implement total issuance lockdown (issue ";") to permanently protect retired or sensitive domains from issuance.

Automated Incident Dispatch (iodef)

Receive real-time alerts via secure email or HTTP POST webhooks whenever an unauthorized certificate request is denied by a compliant CA during automated pre-issuance checks.

Technical Reference & Architecture Guide

DNS CAA (Certification Authority Authorization) Record Generator — Reference Guide

Construct RFC 8659 compliant DNS CAA records to restrict SSL/TLS certificate issuance to trusted authorities (Let's Encrypt, DigiCert, Sectigo).

Key Parameters & Controls

flagsinteger (0-255)

Unsigned 8-bit flag byte. Bit 0 represents the Issuer Critical Flag (128). If 0, CAs may ignore unrecognized tags; if 128, CAs must abort issuance if any tag or parameter is unsupported.

Default: 0
tagenum (issue | issuewild | iodef)

Authorization directive: 'issue' authorizes CA certificate issuance, 'issuewild' authorizes wildcard certificates, and 'iodef' specifies incident reporting endpoints.

Default: issue
valuestring

Authorized CA canonical identifier (e.g. 'letsencrypt.org', 'digicert.com'), incident report URI ('mailto:[email protected]'), or ';' to deny all issuance.

Default: letsencrypt.org
accountUristring (optional parameter)

ACME account binding constraint (e.g. accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/123456) preventing unauthorized certificate issuance from other accounts.

ttlnumber (seconds)

Time To Live in seconds controlling DNS resolver cache validity for the CAA resource record.

Default: 3600

Pro Tips & Best Practices

If your service does not

If your service does not require wildcard certificates (*.example.com), add a dedicated '0 issuewild ";"' record. Even if 'issue' records permit a CA, an explicit semicolon in issuewild forbids any wildcard issuance.

Modern CAs like Let's Encrypt

Modern CAs like Let's Encrypt support the 'accounturi' parameter. Configuring '0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/ID"' ensures only your automated cluster can issue certificates, even if DNS control validation is temporarily intercepted.

Publish an 'iodef' record

Publish an 'iodef' record with 'mailto:[email protected]' or an HTTPS telemetry endpoint. RFC 8659 compliant CAs will automatically dispatch structured incident reports whenever an unpermitted party attempts certificate issuance.

CAs traverse up DNS labels

CAs traverse up DNS labels from child subdomains to the root apex until a CAA record set is found. If you define CAA records on example.com, all subdomains automatically inherit them unless explicitly overridden with a child CAA record.

Common Gotchas & Troubleshooting

Automated ACME certificate renewal fails with 'CAA record does not permit issuance'.

Verify that your DNS zone contains an 'issue' tag matching the exact CA identifier (e.g., 'letsencrypt.org' or 'digicert.com'). Also verify that DNSSEC is intact, as failing DNSSEC validation forces RFC 8659 compliant CAs to treat CAA lookups as SERVFAIL and deny issuance.

Setting flag to 128 results in certificate request rejection or processing errors.

Flag 128 activates the Issuer Critical requirement. If you specify parameters (like custom validation methods) that the target CA does not recognize or support, the CA is legally required under RFC 8659 to reject the issuance. Change flag to 0 or consult CA parameter documentation.

DNS provider UI reports invalid format or syntax error when saving CAA records.

DNS interfaces vary: Cloudflare and AWS Route 53 offer structured input fields (Flag, Tag, Value), whereas BIND and RFC zone files require the full line: 'example.com. 3600 IN CAA 0 issue "letsencrypt.org"'. Do not wrap values in double quotes if the provider UI already auto-escapes them.

Frequently Asked Questions

What is a DNS CAA record and why is it mandatory for CAs to check?▼

A DNS Certification Authority Authorization (CAA, RFC 8659) record allows domain holders to specify which Certificate Authorities are authorized to issue SSL/TLS certificates for their domain. Since September 8, 2017, the CA/Browser Forum Baseline Requirements have made CAA checking mandatory for all publicly trusted CAs before signing any certificate.

How can I completely block all SSL/TLS certificate issuance for an unused domain?▼

Publish two CAA records with a semicolon value: '0 issue ";"' and '0 issuewild ";"'. Compliant CAs interpret a standalone semicolon as an explicit instruction that no CA is permitted to issue certificates for that domain.

Can I authorize multiple Certificate Authorities simultaneously?▼

Yes. You can publish multiple CAA records for the same domain. For instance, creating two separate records with '0 issue "letsencrypt.org"' and '0 issue "digicert.com"' allows both Let's Encrypt and DigiCert to issue certificates, while blocking all other CAs.

How does CAA inheritance (Tree Climbing) work for subdomains?▼

When evaluating a domain such as api.internal.example.com, the CA first queries for CAA records at that exact FQDN. If none exist, it strips the left-most label and queries internal.example.com, and finally example.com. The first CAA record set encountered stops the search. If no CAA records exist at any level up to the TLD, any authorized CA can issue certificates.

What is the difference between 'issue' and 'issuewild' tags?▼

The 'issue' tag authorizes certificate issuance for both single-name/SAN certificates and wildcard certificates by default. However, if an 'issuewild' tag is present in the record set, it takes precedence over 'issue' strictly for wildcard (*.example.com) requests, allowing domain owners to decouple wildcard authority from standard host certificates.

Related Tools & Utilities

All Tools →
DNS DKIM TXT Record Builder & Selector HelperSecurity

Generate RFC 6376 compliant DNS DKIM TXT records with selector, public key formatting (v=DKIM1; k=rsa; p=...), and verification guidance.

Open tool→
MTA-STS Policy & TLS-RPT DNS Record GeneratorSecurity

Generate RFC 8461 Mail Transfer Agent Strict Transport Security (MTA-STS) policy files and _mta-sts/_smtp._tls DNS TXT records.

Open tool→
JWT Token Decoder & Security InspectorSecurity

Decode JSON Web Tokens, inspect header/payload claims, calculate expiration time and verify integrity locally.

Open tool→
Cryptographically Secure Password GeneratorSecurity

Generate ultra-secure passwords using Web Crypto API with custom length, symbols, and memorability.

Open tool→
Multi-Algorithm Hash Generator (SHA-256, SHA-512, MD5)Security

Compute instant cryptographic hashes entirely in browser with zero server transmission.

Open tool→
JSON Web Token (JWT) Debugger & Signature VerifierSecurity

Decode, verify, and inspect JWT headers, payloads, and claims with local secret or public key without sending data to servers.

Open tool→