The CAA record generator lets you create DNS CAA records that specify which certificate authorities are allowed to issue SSL certificates for your domain.
Create the following CAA records for .
No certificate authority is selected, so no certificate authority will be allowed to issue certificates for this domain.
| Hostname |
Type |
Flag |
Tag |
Value |
CAA records are created for your domain name and also apply to all of its subdomains, unless a subdomain has CAA records of its own. Please specify your domain name below to get started.
Which certificate authorities may issue certificates for your domain?
Select every certificate authority you obtain certificates from, including any used by your hosting provider or CDN. Certificate authorities that are not listed will be refused.
Wildcard certificates such as *.example.com may only be issued by the certificate authorities ticked in the Wildcard column. Untick every Wildcard box to forbid wildcard certificates.
Enter the CAA domain of any other certificate authority, separated by commas. The certificate authority's documentation lists the value to use.
Enter the CAA domain of any other certificate authority that may issue wildcard certificates, separated by commas. This box follows the one above until you change it.
Certificate authorities may notify you of certificate requests that violate your CAA policy. Enter an email address or a URL (optional).
CAA Tags
| Tag |
Description |
| issue |
Authorizes a single certificate authority to issue certificates of any type for the domain. Add one issue record per certificate authority. A value of ";" forbids issuance by every certificate authority. |
| issuewild |
Authorizes a certificate authority to issue wildcard certificates. When present, it overrides the issue tag for wildcard certificates only. |
| iodef |
Specifies an email address (mailto:) or URL where certificate authorities can report certificate requests that violate the policy. |
