Home Icon > Resources > Expert Guides > SSL/TLS Best Practices > Do I need a CAA Record? How to Check & Add One

Do I need a CAA Record? How to Check & Add One

A CAA (Certificate Authority Authorization) record is a key DNS record that gives domain owners control over which Certificate Authorities (CAs) can issue SSL/TLS certificates for their domain. This system makes sure that only approved CAs can provide certificates, which boosts domain security and cuts down the chance of certificate abuse. To prevent unauthorized SSL certificate issuance and to ensure that trusted CAs can provide certificates for your domain, it’s essential to manage CAA records.  

This article shows you how to create and add a CAA record for caa.itsatestsite.online with an online tool. You’ll also find general steps to add CAA records to Windows/IIS, CentOS/Apache, and Ubuntu/Nginx servers. In the end, you’ll learn to check CAA records using the CertPanel SSL Monitor. 

What is a CAA Record? 

A CAA record is a DNS entry that specifies which CAs have permission to issue certificates for a domain. It makes sure approved CAs can provide certificates, which helps to reduce the risks linked to unauthorized issuance. 

Components of a CAA Record: 

  1. Flag: Indicates whether the record is critical.
    • 0: Not critical 
    • 1: Critical – The CA must respect the directive. 
  2. Tag: Specifies the purpose or property. 
    • issue – Authorizes a specific CA. 
      • Example: CAA 0 issue “sectigo.com” 
    • issuewild – Authorizes wildcard certificates. 
      • Example: CAA 0 issuewild “sectigo.com” 
    • iodef – Specifies where to send policy violation reports. 
      • Example: CAA 0 iodef mailto:admin@yourdomain.com 
  3. Value: Contains the CA’s domain or contact details for reporting violations. 

Generating and Adding a CAA Record for AWS Route 53 

We will use The SSL Store’s CAA Record Generator Tool to create a CAA record for the domain caa.itsatestsite.online and add it to AWS Route 53. 

Step 1: Generate the CAA Record 

  1. Visit The SSL Store’s CAA Record Generator. 
  2. Enter the domain name caa.itsatestsite.online, and click Generate CAA Record. 
  1. The generated CAA output will be: 

Standard BIND Zone File 

caa.itsatestsite.online. IN CAA 0 issue “sectigo.com” 

Step 2: Add the CAA Record in AWS Route 53 

  1. Log in to the AWS Management Console. 
  2. Navigate to Route 53 and select your hosted zone. 
  3. Click Create Record. 
  4. Enter the following details: 
    • Record Name: caa 
    • Record Type: CAA 
    • Value:  0 issue “sectigo.com”   
    • TTL: 300 (recommended) 
  5. Click Create Record to save the changes. 
  1. Use the CertPanel SSL Monitor to verify the CAA record has been successfully added. 

Adding CAA Records to Other Servers 

Windows/IIS 

  1. Open DNS Manager. 
  2. Select your domain and right-click to add a New Record > CAA Record. 
  3. Fill in the following: 
    • Flag: 0 
    • Tag: issue 
    • Value: “sectigo.com” 
  4. Save and apply the changes. 

CentOS/Apache 

  1. Open the DNS zone file using a text editor: 
# sudo vim /etc/named/yourdomain.com.zone 
  1. Add the following entry: 
yourdomain.com. IN CAA 0 issue "sectigo.com" 
  1. Save the file and restart the DNS service: 
# sudo systemctl restart named   

Ubuntu/Nginx 

  1. Access the DNS zone file: 
# sudo vim /etc/bind/ db.yourdomain.com
  1. Add the following CAA record: 
yourdomain.com. IN CAA 0 issue "sectigo.com" 
  1. Save the changes and restart Bind: 
# sudo systemctl restart bind9 

Checking Server Vulnerabilities for CAA Records 

Using the CertPanel SSL Monitor, you can quickly check if the CAA record is correctly configured and detect any vulnerabilities. 

Steps to Verify CAA Record Using CertPanel SSL Monitor: 

  1. Log in to CertPanel and entered the domain name i.e. caa.itsatestsite.online under the SSL Monitor section  
  1. Click Scan to review the status of the CAA Record. If any issues are detected, please follow the suggested remediation steps provided by the tool. 

CAA Record Example 

Below is the complete CAA record configuration for caa.itsatestsite.online:  

caa.itsatestsite.online. IN CAA 0 issue "sectigo.com"   
caa.itsatestsite.online. IN CAA 0 issuewild "sectigo.com"   
caa.itsatestsite.online. IN CAA 0 iodef mailto:admin@caa.itsatestsite.online

Final words on CAA Records

CAA records play a key role in stopping unauthorized SSL certificate issuance by limiting which CAs can issue certificates for a domain. You can handle CAA records for your domain by using The SSL Store’s CAA Record Generator and adding the record to AWS Route 53. Also, by following the steps for Windows/IIS, CentOS/Apache, and Ubuntu/Nginx, you can make sure your DNS records are set up . Keeping an eye on things with the CertPanel SSL Monitor helps to keep your domain safe and in line with rules. 

Related Links