A CAA (Certification Authority Authorization) DNS record lists which Certificate Authorities are allowed to issue certificates for your domain. CAs are required to check it before issuing, which reduces the risk of unauthorised or mis-issued certificates.
CAA is resolved up the domain tree. If a hostname has no CAA record, the CA walks up to the parent domain, and its parent, until it finds one. This tool shows the full lookup chain and the effective policy that applies.
The issue tag authorises a CA to issue normal certificates; issuewild specifically controls wildcard certificate issuance. If issuewild is absent, wildcard issuance falls back to the issue policy.
No. CAA constrains which CAs may issue, but it does not stop a compliant CA you have authorised, nor a CA that ignores CAA. Combine CAA with Certificate Transparency monitoring for defence in depth.
It is optional but recommended. Restricting CAA to only the CAs you actually use is a simple, low-risk way to shrink your certificate attack surface, and some compliance frameworks expect it.
We're new and growing — your feedback helps us improve.