[ DNS & domains ]

DNS CAA records: understand their role in certificate issuance

Map CAA issuer authorization to actual certificate workflows, distinguish wildcard rules and renewal risks, and keep certificate governance separate from email authentication.

By the EmailAuth research team · 9 min read

[ Key points ]

  • CAA governs certificate issuance, not email sender authentication.
  • Review the applicable record set for every requested certificate name.
  • Validate managed issuance and renewal before accepting a CAA change.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Authorize only the issuers required by documented certificate workflows, preserve wildcard and alias-processing nuance, and test renewal without counting CAA as SPF, DKIM or DMARC evidence.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Inventory certificate dependencies

Branded email-service endpoints may depend on managed certificate renewal.

Next steps

  1. List exact names and certificate operators.
  2. Obtain supported issuer identifiers.
  3. Test the actual renewal workflow.

CISO / SecOps

Make authorization intentional

CAA policy should reflect approved issuer authority rather than accumulated exceptions.

Next steps

  1. Review every additional issuer.
  2. Check wildcard and critical-property behavior.
  3. Preserve separate email-authentication controls.

Founder / Non-technical

Avoid a delayed HTTPS outage

A DNS policy change can appear harmless until certificate renewal.

Next steps

  1. Assign ownership for managed endpoints.
  2. Require a renewal-safe rollout plan.
  3. Escalate unverified provider dependencies before release.

[ FAQs ]

Frequently asked questions

Does CAA authenticate messages sent from my domain?

No. It expresses certificate-issuance authorization. SPF, DKIM and DMARC establish different email-authentication properties.

RFC 8659

Will a new CAA policy revoke existing certificates?

No. CAA is an issuance control. Existing certificate validity and revocation are separate mechanisms, so a working old certificate is not renewal evidence.

RFC 8659

Does issuewild restrict non-wildcard certificate requests?

No. It applies to wildcard issuance. For wildcard requests, relevant issuewild properties take precedence over issue; without issuewild, issue governs wildcard issuance too.

RFC 8659

Is a CAA record required at every hostname?

Not necessarily. The relevant-set algorithm queries the requested name and climbs its parent names until it finds a CAA set, with aliases handled by ordinary DNS lookup.

RFC 8659

Does an empty issuer entry override another allowed issuer?

No. Authorizations are additive. An empty issuer alongside a non-empty authorized issuer does not cancel that authorization.

RFC 8659

Does setting the flags field to 1 make a property issuer-critical?

No. The issuer-critical bit has numeric value 128. An unknown or unsupported critical property prevents issuance under the applicable set.

RFC 8659

Can I copy accounturi restrictions from another deployment?

No. RFC 8657 account and validation-method restrictions require the right supported CA, account and method values. Confirm the actual certificate workflow before applying them.

RFC 8657

Which tests were completed for this guide?

Only documentary source review was performed. Live CAA publication, certificate issuance or renewal, provider behavior, visual review and owner approval remain unverified.

[ Sources ]

Sources

  1. RFC 8659

    Sections §1 Introduction · §3 Relevant Resource Record Set · §4.1 Syntax · §4.2 CAA issue Property · §4.3 CAA issuewild Property · §4.4 CAA iodef Property · §4.5 Critical Flag · §6 Deployment Considerations · §7 Differences from RFC 6844

  2. RFC 9499

    Sections §2 Names · §5 Resource Records · §7 Zones

  3. RFC 8657

    Sections §3 Extensions to the CAA Record: The "accounturi" Parameter · §3.1 Use with ACME · §4 Extensions to the CAA Record: The "validationmethods" Parameter · §5.2 Restrictions Ineffective without CA Recognition · §5.8 Misconfiguration Hazards

[ Glossary ]

Glossary

CAA
A DNS record expressing certificate-authority authorization for issuance.

RFC 8659

Relevant RRset
The CAA record set selected by the standard lookup procedure for a requested name.

RFC 8659

issuewild
The CAA property that governs wildcard issuance when present in the relevant set.

RFC 8659

Issuer-critical flag
The flag requiring a CA not to issue when a relevant critical property is unknown or unsupported.

RFC 8659

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base