CAA Record Generator<\/a> tool.<\/figcaption><\/figure><\/div>\n\n\n\nNow, you might be thinking: \u201cUgh, do I really<\/em> need to know all of this to create a CAA record?\u201d In most cases, no. That\u2019s because, if you\u2019re like most people, you use your domain registrar\u2019s DNS servers rather than running one of your own. When you use third-party DNS servers, you can just use their systems or your control panel to create CAA DNS records.<\/p>\n\n\n\nWe\u2019ll actually show you how to do that in cPanel a little later. But first, we still have a few more things to cover.<\/p>\n\n\n<\/span>\n\n\nWhat Goes Into a CAA Record<\/h3>\n\n\n\n For the purpose of this article, we\u2019re going to focus on the CAA record canonical presentation format as it\u2019s outlined in RFC 8659 (since it obsoletes RFC 6844):<\/p>\n\n\n\n
CAA <flags> <tag> <value><\/code><\/pre>\n\n\n\nRemember seeing something like this a little earlier? We\u2019re going to break down what each part of it means.<\/p>\n\n\n\n
This is an illustrative example and breakdown of a CAA record.<\/figcaption><\/figure><\/div>\n\n\n\nAs you can see in this example above, a DNS CAA record has surprisingly pretty basic setup \u2026 so long as you know what the different parts of it are, that is. Otherwise, it can be a bit confusing.<\/p>\n\n\n\n
DNS CAA records include the following components:<\/p>\n\n\n\n
\nFlags<\/strong> \u2014 A flag, as outlined in RFC 6844, can be one of two specific states: 1<\/em> (critical) or 0<\/em> (non-critical) with 0 as the default. However, much like with the tags, a CA can create their own custom flags as well to give specific directions for issuance.\n\nThe 1<\/strong> flag tells the CA that it can\u2019t use the CAA record in the zone if it doesn\u2019t understand the property. Basically, it tells it that it can\u2019t proceed further with trying to issue the certificate and should send an email notifying the domain owner about the CAA record check failure.<\/li>\n\n\n\nThe 0<\/strong> flag tells the CA that it can use any CAA record info in the zone regardless of whether it understand the property. If it doesn\u2019t understand this CAA record, it can skip over it and use another in the DNS zone file.<\/li>\n<\/ul>\n<\/li>\n\n\n\nTags<\/strong> \u2014 A tag specifies which actions an authorized CA can take in terms of issuing SSL\/TLS certificates. The three tags that are outlined in RFC 6844 are issue<\/em>, issuewild<\/em>, and iodef<\/em>. However, it\u2019s important to note that CAs can also specify their own custom tags to provide directions for the cert issuance process.\n\nThe issue<\/strong> tag authorizes a specific CA to issue non-wildcard certificates for the domain and any of its subdomains. However, this tag can also be used to restrict any CAs from issuing non-wildcard certificates for those same subdomains (a little more on that momentarily).<\/li>\n\n\n\nThe issuewild<\/strong> tag authorizes a specific CA to issue wildcard certificates for the domain.<\/li>\n\n\n\nThe iodef<\/strong> tag (what stands for \u201cincident object description exchange format\u201d) provides info about invalid certificate requests. Basically, this gives you (as the domain owner), the ability to receive an email whenever a certificate request fails a CAA check. This way, you can stay abreast of CAA-related issues and fix the error that causes the failure.<\/li>\n<\/ul>\n<\/li>\n\n\n\nValues<\/strong> \u2014 A value (typically listed between double quotation marks) is the domain of the CA that has the authority to issue certificates for the domain in question. If the value is a semicolon (;), it means that no CA has the authority to issue a certificate for that domain. <\/li>\n\n\n\nTTL<\/strong> \u2014 A TTL field, which stands for \u201ctime to live,\u201d refers to the period of time (seconds) that a server should keep your CAA record in its cache.<\/li>\n<\/ul>\n\n\n\nYeah, that was a lot to take in. Take a deep breath and grab some more coffee \u2018cause we\u2019re not done yet. Now it\u2019s time to put all of this together.<\/p>\n\n\n\n
Examples of DNS CAA Records<\/h3>\n\n\n\n Let\u2019s say, for example, that we want a CAA DNS record for TheSSLStore.com that specifies that only DigiCert and Sectigo can issue non-wildcard certificates for the TheSSLstore.com. The CAA record would look something like this:<\/p>\n\n\n\n
thesslstore.com. CAA 0 issue \u201cdigicert.com\u201d\nthesslstore.com. CAA 0 issue \u201csectigo.com\u201d<\/code><\/pre>\n\n\n\nNow, if we want to ensure that only Sectigo can issue wildcards and only DigiCert can issue other SSL\/TLS certificates, the CAA DNS record would look something like this:<\/p>\n\n\n\n
thesslstore.com. CAA 0 issue \u201cdigicert.com\u201d\nthesslstore.com. CAA 0 issuewild \u201csectigo.com\u201d<\/code><\/pre>\n\n\n\nNow, to set IODEF properties for your CAA record, the syntax should look something like this:<\/p>\n\n\n\n
thesslstore.com. CAA 0 issue \u201cdigicert.com\u201d\nthesslstore.com. CAA 0 iodef \u201cmailto:email@thesslstore.com\u201d\nthesslstore.com. CAA 0 iodef \u201chttp:\/\/iodef.thesslstore.com\u201d<\/code><\/pre>\n\n\n\nOkay, now that we know what CAA records are and how they look, let\u2019s jump into how you can put them to use for your website.<\/p>\n\n\n\n
How to Add, Edit, or Create a CAA Record<\/h2>\n\n\n\n There are multiple ways that you can add, edit, or create a CAA certificate record for your domain or subdomain. For example, if you have your own DNS server and want to add or edit your CAA record directly in the DNS BIND file, you\u2019ll want to:<\/p>\n\n\n\n
\nUse Notepad to open your domain\u2019s DNS file.<\/strong> This avoids inadvertently adding any code that other word processing programs like Microsoft Word.<\/li>\n\n\n\nAdd or update the DNS CAA record information to that file.<\/strong> This is where you add or alter the information (tags, values, flags, etc.) like what you see above.<\/li>\n\n\n\nSave the zone file in Notepad and close out of it.<\/strong><\/li>\n<\/ol>\n\n\n\nThat\u2019s it!<\/p>\n\n\n\n
But what if you want to create a CAA record using your control panel or your domain registrar\u2019s DNS? No worries, you can do that easily. We\u2019ve put together direction for cPanel (below). For your third-party domain registrar, though, you\u2019ll have to go through them directly.<\/p>\n\n\n\n
How to Add a CAA Record in cPanel<\/h3>\n\n\n\n If you wish to create a certificate authority authorization record within cPanel, you can do that as well by doing the following:<\/p>\n\n\n\n
1. Log into your cPanel account.<\/p>\n\n\n\n
2. Scroll down to the Domains section and select Zone Editor<\/strong>.<\/p>\n\n\n\n4. In the Zone Editor, look for a blue button labeled Add Record<\/strong> and click the down arrow. From the drop-down list, select Add \u201cCAA\u201d Record<\/strong>.<\/p>\n\n\n\n5. In the Zone Editor menu for that specific domain, select the right option or fill in the missing info for the form\u2019s required fields. This includes:<\/p>\n\n\n\n
\nThe name<\/strong> of the website (the domain or sub-domain you wish to add a CAA record for).<\/li>\n\n\n\nThe record type<\/strong> (CAA).<\/li>\n\n\n\nThe flag<\/strong> (0 or 1).<\/li>\n\n\n\nThe tag<\/strong> (issue, wildissue, iodef).<\/li>\n\n\n\nThe value<\/strong> (the domain of the CA that you\u2019re giving authority to create SSL\/TLS certificates).<\/li>\n<\/ul>\n\n\n\nOnce you\u2019ve completed these steps, simply select Add Record<\/strong> next to the entry on the right-hand side to save your work.<\/p>\n\n\n\nThat\u2019s it!<\/p>\n\n\n\n
How CAA Works & the Role Certificate Authority Authorization Plays in Cert Issuance<\/h2>\n\n\n\n Whenever a certificate authority receives a request to issue a new certificate, they first check to see whether any CAA records exist for that domain. This is because of the CA\/B Forum ruling that dictates that all commercial CAs must check for CA records before issuing any certificate.<\/p>\n\n\n\n
Here\u2019s what happens when a publicly trusted CA runs a CAA DNS records check:<\/p>\n\n\n\n
\nIf there is a CAA record:<\/strong> The CA must check to see whether they are authorized to issue a cert and verify that the certificate request matches the CAA record specifications.\n\nIf yes to both, then the CA can move to the next phase of the certificate issuance process.<\/li>\n\n\n\n If no to one or both, then the CA should reject the request outright.<\/li>\n<\/ul>\n<\/li>\n\n\n\n If no CAA DNS record exists:<\/strong> If the CA can\u2019t find a CAA record for the domain in question, it will proceed with next phase of the certificate issuance process.<\/li>\n<\/ul>\n\n\n\nIt\u2019s important to note, though, that CAA records work hierarchically. This means that if someone requests a certificate for one of your subdomains and there\u2019s no CAA record available for that subdomain, the CA will automatically look at the next level up in the DNS name tree to search for a CAA record there. If they find one on the root domain, that will be used for the subdomain in question as well.<\/p>\n\n\n\n
But where exactly does the CAA records check fit into the certificate issuance process for publicly trusted CAs?<\/p>\n\n\n\n
This graphic illustrates the certificate issuance process for publicly trusted CAs and where the CAA record check fits into that process.<\/figcaption><\/figure><\/div>\n\n\n\nA Look at Certificate Authority Authorization in Action\u2026<\/h3>\n\n\n\n Let\u2019s consider the following example to better understand how certificate authority authorization applies to a real-world situation.<\/p>\n\n\n\n
Say you want to authorize Sectigo and DigiCert to issue certificates on your behalf but no one else. What you\u2019ll do is create a CAA DNS record. This CAA record makes it so that any time a request for a new certificate goes to a publicly trusted CA, they\u2019ll see the record that says only those two specific CAs can issue certificates for your domain. So, when the CA checks for the domain\u2019s CAA DNS record, they\u2019ll see that they basically have either a red light or a green light in terms of whether they halt or continue with the certificate issuance process.<\/p>\n\n\n\n
This means that if someone tries to request a certificate for your domain through another publicly trusted CA \u2014 GoDaddy, Let\u2019s Encrypt, or anyone else \u2014 their certificate signing requests will receive the big, fat stamp of rejection.<\/p>\n\n\n\n
One last quick but also important note:<\/strong> Although all CAs are required to perform a CAA DNS records check, it doesn\u2019t mean that you as the domain name owner have to create a CAA record. If you don\u2019t have any CA-related requirements that you need to specify, then you don\u2019t have to create a CAA record. There\u2019s no obligation one way or the other for domain owners.<\/p>\n\n\n\nBut what are the advantages of using CAA for your domain (and subdomains)?<\/p>\n\n\n\n
Why You May Want to Consider Creating a CAA DNS Record for Your Domain<\/h2>\n\n\n\n Despite the issues that have come up previously, using a CAA helps you to prevent certificate mis-issuance. Some of the biggest advantages of implementing certificate authority authorization include:<\/p>\n\n\n\n
\nPreventing fraud or misrepresentation of your brand.<\/strong> Specifying which CA (or CAs) can issue certs for your domain helps you to prevent cybercriminals from requesting unauthorized certificates through unauthorized CAs. This helps to protect the identity of the certificate holder.<\/li>\n\n\n\nLimiting shadow certificates.<\/strong> By making it so that only the CAs that you have company accounts with can issue certs for your domain may help you to limit shadow certificates.<\/li>\n\n\n\nAdding an additional layer of security prior to certificate issuance. <\/strong>Requiring this CAA records check through the DNS is a more technical way of ensuring that a CA verifies whether they have the authority to fulfill a certificate request. <\/li>\n\n\n\nShowing your preference and support for specific CAs.<\/strong> If, for one reason or another, you only want your organization\u2019s name or reputation associated with a particular publicly trusted CA, you can make that possible with CAA.<\/li>\n\n\n\nEnhanced certificate management.<\/strong> With CAA, you can better manage your certificates under one umbrella rather than trying to track certificates from multiple CAs.<\/li>\n<\/ul>\n\n\n\nNeed to Generate a CAA DNS Record? Look No Further<\/h2>\n\n\n\n Did you know that we have a CAA record generator tool<\/a> here at The SSL Store? Not to toot our horn (at least not too much), but it\u2019s actually a really great way to automatically generate a DNS record for your domain. And if you have a DNS through your domain registrar, we have directions there for how to create a CAA DNS record for multiple providers, too.<\/p>\n\n\n\nWhether you choose to set up a CAA DNS record or not is entirely up to you. As an SSL\/TLS certificate provider that works with many of the world\u2019s leading CAs, we have no dog in this race. We just want to ensure you have as much information as possible to make an informed decision about what\u2019s best for your brand identity and domain security.<\/p>\n\n\n<\/span>\n\n\nFinal Thoughts on Certificate Authority Authorization and DNS CAA Records<\/h2>\n\n\n\n As you can see, using CAA has its advantages. Not only does it give you greater control of managing your domain\u2019s SSL\/TLS certificates, but it also gives you greater control of your brand identity as a result. While it\u2019s not perfect, and you certainly can see the progression of this standard over time in the IETF\u2019s requests for comments, certificate authority authorization does hold promise and is a great way to add another layer of identity and security to your domain.<\/p>\n\n\n\n
We hope this article has provided you with greater clarity about what CAA is and why creating a CAA DNS record may be valuable for your organization. There are a lot of important little pieces that make up each CAA record, and understanding the role of each component is crucial to making the use of CAA most valuable for your organization or business.<\/p>\n\n\n\n
Have questions or additional insights? Feel free to share in the comments below\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"
Did you know that there\u2019s an easy way to control which CAs can issue certificates for your domain? Here\u2019s everything to know about CAA records for your DNS.<\/p>\n","protected":false},"author":17,"featured_media":12640,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16,10200],"tags":[2413,12586],"class_list":["post-12621","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","category-monthly-digest","tag-caa","tag-certificate-authority-authorization","post-with-tags"],"views":64786,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/caa-record-dns.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/12621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=12621"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/12621\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/12640"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=12621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=12621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=12621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}