CAA Record Generator
Generate CAA records to control which certificate authorities may issue SSL certificates for your domain. Free, with issue, issuewild and iodef support.
Configure your CAA record
Choose which certificate authority may issue certificates for your domain.
Your CAA records
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 issuewild "letsencrypt.org"What this CAA generator does
Common use cases
- 1Restricting who can issue SSL certificates for your domain
- 2Preventing unauthorised or mis-issued certificates
- 3Meeting a security or compliance requirement
- 4Allowing a specific CA before requesting a cert
- 5Adding certificate-issuance monitoring (iodef)
- 6Controlling wildcard certificate issuance
Related tools
About CAA records
A CAA (Certification Authority Authorization) record lists which certificate authorities are allowed to issue SSL/TLS certificates for your domain. Before issuing, a compliant CA checks your CAA record and refuses if it is not listed — a strong defence against mis-issuance.
Use issue for standard certificates, issuewild for wildcards, and iodef to receive reports of blocked attempts. Because CAA is restrictive, always include every CA you use — this generator formats the records for you.
More Free Tools Where This Came From
This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.
HostCloud.in · Pune, India · Serving 34,987+ Websites Since 2020
Got Questions? We Have Answers.
What is a CAA record?
A CAA (Certification Authority Authorization) record lists which certificate authorities are allowed to issue SSL/TLS certificates for your domain, reducing the risk of mis-issuance.
What is the difference between issue and issuewild?
issue authorises standard certificates; issuewild specifically authorises wildcard certificates. If issuewild is absent, the issue rule also applies to wildcards.
What does iodef do?
iodef sets a contact (email or URL) where CAs can report attempts to issue a certificate that your CAA policy blocked.
Will a CAA record break my existing certificates?
No, it does not affect already-issued certificates. But future issuance fails if the requesting CA is not listed, so include every CA you use.
Which CA value do I use?
The CA's CAA identifier domain — for example letsencrypt.org, digicert.com or sectigo.com. The generator offers common ones.
Is anything sent to a server?
No. The records are built entirely in your browser.