Certification Authority Authorization (CAA) FAQ
The following page answers common questions about Certification Authority Authorization (CAA
) records.
A Certificate Authority Authorization (CAA) DNS record specifies which certificate authorities (CAs) are allowed to issue certificates for a domain. This record reduces the chance of unauthorized certificate issuance and promotes standardization across your organization.
For more details, refer to Create CAA records.
CAA
records�are evaluated by a CA, not by Cloudflare.
If you are part of a large organization or one where multiple parties are tasked with obtaining SSL certificates, include�CAA
records�that allow issuance for all CAs applicable for your organization.�Failure to do so can inadvertently block SSL issuance for other parts of your organization.
Cloudflare adds CAA records automatically in two situations:
- When you have Universal SSL or advanced certificates and add any CAA records to your zone.
- When you have Universal SSL enabled and enable AMP Real URL or SXG Signed Exchanges.
These records make sure Cloudflare can still issue Universal certificates on your behalf.
If Cloudflare has automatically added CAA records on your behalf, these records will not appear in the Cloudflare dashboard. However, if you run a command line query using dig
, you can see any existing CAA records, including those added by Cloudflare (replacing example.com
with your own domain on Cloudflare):
➜ ~ dig example.com caa +short# CAA records added by DigiCert0 issue "digicert.com; cansignhttpexchanges=yes"0 issuewild "digicert.com; cansignhttpexchanges=yes"
# CAA records added by Sectigo0 issue "sectigo.com"0 issuewild "sectigo.com"
# CAA records added by Let's Encrypt0 issue "letsencrypt.org"0 issuewild "letsencrypt.org"
# CAA records added by Google Trust Services0 issue "pki.goog; cansignhttpexchanges=yes"0 issuewild "pki.goog; cansignhttpexchanges=yes"