Build CAA (Certification Authority Authorization) DNS records that control which Certificate Authorities are allowed to issue SSL/TLS certificates for your domain. Choose your allowed CAs, add wildcard rules and violation reporting, then copy the ready-to-paste records into your DNS.
A CAA (Certification Authority Authorization) record is a DNS record that tells Certificate Authorities which CAs are permitted to issue SSL/TLS certificates for your domain. By default, any public CA can issue a certificate for any domain, which means a misconfigured or compromised CA anywhere in the world could issue a valid certificate for your site without your knowledge. A CAA record closes that gap: CAs are required by the CA/Browser Forum baseline requirements to check it before issuing, and to refuse issuance if the record does not list them. Adding a CAA record is one of the simplest, highest-value hardening steps you can take against mis-issuance and certificate-based impersonation.
Enter your domain, then add one authorization per rule. Pick a tag: issue authorizes standard certificates, issuewild authorizes wildcard certificates, and iodef sets a mailto: or https:// endpoint where CAs report policy violations. Choose your CA from the dropdown (Let's Encrypt, Google Trust Services, DigiCert, Sectigo/Comodo, GlobalSign, Amazon, Buypass, ZeroSSL) or type a custom CA domain. The tool live-builds the zone-file record and a separate flag, tag, and value breakdown for DNS panels like Cloudflare and cPanel. Click the record to copy it. Use the presets for the two most common setups: allow only Let's Encrypt, or block all issuance with issue ";".
List every CA you actually use, including for wildcards, since if you use a wildcard certificate you must add an issuewild rule (issue alone does not cover wildcards). Remember that many CAs issue under a different CAA domain than their brand name: ZeroSSL certificates validate against sectigo.com, and Amazon uses amazon.com. To forbid all issuance, use the value ";" on an issue tag rather than trying to "allow none". Set the critical flag (128) only when you want CAs to hard-fail on any tag they do not understand; 0 is the safe default. Add an iodef contact so you are notified of attempted violations. After publishing, re-check your DNS and remember that CAA is only evaluated at issuance time, so it does not affect certificates already issued.
Need reliable hosting? These free tools are brought to you by Ultra Web Hosting. Fast, secure shared and reseller hosting with 24/7 expert support. View hosting plans →