What is a CAA record?
A DNS record naming the certificate authorities allowed to issue certificates for your domain.
Written by the SkyQon engineering team · Last verified 4 August 2026
Why it matters
Without CAA, any publicly trusted certificate authority in the world may issue a certificate for your domain. CAA is the DNS record that narrows that list to the authorities you actually use, and it is checked by the CA at the moment of issuance.
The standard
RFC 8659 (2019), which replaced RFC 6844. A CAA record names permitted issuers using the issue and issuewild tags, and can carry an iodef address that receives reports of refused issuance attempts.
Official text: RFC 8659
How it fails
Because CAA is enforced at issuance and not at connection, a wrong record never breaks your live site — it breaks your next renewal, usually at the least convenient moment. Adding a new CA or ACME provider without updating CAA first produces a refusal that reads like a broken certificate pipeline rather than a DNS problem.
Related terms
Check this on your own domain
SkyQon reads the same public signals described on this page and scores them for your domain. No account, no agent, nothing to install — a scored report by email in minutes.