Do Certificate Authorities Use CAA?

Half of the Certificate Authority (CA) companies trusted by Chrome place no limits on who can issue TLS certificates for their own domains.

We checked the CAA records of all 44 CAs trusted by Chrome. 22 set no CAA restrictions.

In this post, we explain how CAA records work, how we measured adoption, and a command you can use to check your own domain today.

What a CAA Record Does

A Certification Authority Authorization (CAA) DNS record specifies which CAs are allowed to issue certificates for a domain. It uses three main tags:

• issue: Authorizes a specific CA to issue certificates for the domain.
• issuewild: Authorizes a CA to issue wildcard certificates specifically.
• iodef: Specifies an email address or URL where CAs can report refused requests. This tag does not restrict issuance.

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:security@example.com"

Since September 8, 2017, all publicly trusted CAs must check CAA records before issuing TLS certificates. The CA/Browser Forum mandated CAA checks in Ballot 187, a rule now enforced under Baseline Requirements §4.2.2.1: CAs "MUST retrieve and process CAA records in accordance with RFC 8659."

CAA lookups traverse up the DNS tree. Under RFC 8659 §3, a CA starts at the requested hostname and moves up label-by-label until it finds a CAA record. For instance, a request for shop.example.com is governed by the record at example.com unless the subdomain has its own.

Crucially, CAA restrictions apply only when a record exists. If no CAA record is found anywhere in the DNS hierarchy, any public CA can issue a certificate once domain control is validated.

Do CAs use CAA on their domains?

Technically, CAs don't really need CAA to operate, but we were curious if CAs themselves adhere to the standard.

Hence, we evaluated every root certificate with "Included" status in the Chrome Root Program using the Common CA Database (CCADB), which is a shared database used by the major browser root programs. This yielded 101 root certificates across 44 CA companies.

The CCADB publishes a CAA identifier report listing the domain names each CA recognizes in an issue tag. The 44 companies listed 97 identifiers, representing 93 distinct domains.

On September 28, 2026, we queried the CAA records for all 93 distinct domains using two public DNS resolvers: 1.1.1.1 and 8.8.8.8.

We recorded the DNS status code of each query and climbed the DNS tree as defined in RFC 8659. Domains categorized as having no record returned a clean NOERROR or NXDOMAIN status on both resolvers.

We sorted every domain into one of two groups:

• Limited domain: its CAA record has at least one issue tag.
• Unlimited domain: it has no CAA record, or its record has no issue tag. Any publicly trusted CA may issue for it, once the requester proves control of the domain.

Note: These identifiers represent the domains each CA recognizes in CAA records, typically including the CA's primary website. Some identifiers serve purely operational roles, such as the four digitalcertvalidation.com subdomains listed by DigiCert.

22 of 44 CAs Set No CAA Limit

The 22 CAs with no issuance limits include well-known organizations: Amazon Trust Services, GoDaddy, HARICA, SECOM, D-TRUST, and Microsoft.

Full list of CAs with no limited domain: Agence Nationale de Certification Electronique (TunTrust), Amazon Trust Services, ANF AC, Asseco (Certum), Atos, Buypass, CFCA, D-TRUST, eMudhra, FNMT, GDCA, GoDaddy, HARICA, Hongkong Post / Certizen, iTrusChina, KIR, Microsoft, NAVER Cloud Trust Services, SECOM, SHECA, Telia, and TWCA.

Two CAs in this group publish CAA records that don't fully restrict issuance:

• microsoft.com includes only a contactemail tag for domain validation contacts:

  $ dig CAA microsoft.com +short
  0 contactemail "caarecordaware@microsoft.com"
  

• telia.fi uses issuewild ";", which blocks wildcard certificates but leaves standard certificates unrestricted.

Two examples from the five CAs in the middle category, which have both limited and unlimited domains:

• DigiCert: Limits digicert.com, but leaves thawte.com, geotrust.com, and rapidssl.com unlimited, with no CAA record.
• Sectigo: Limits sectigo.com, but leaves comodo.com, comodoca.com, and usertrust.com unlimited.

For context, Scott Helme's June 2026 crawl of the Tranco top 1 million sites found that only 53,130 of 819,002 responding domains (6.5%) published CAA records.

While CAs outperform the broader web with 39% limiting every domain, half still leave themselves open.

What a Missing CAA Record Implies

Without a CAA record, any publicly trusted CA can issue certificates for these domains once domain control is validated. A CAA record restricts issuance exclusively to designated CAs.

Although there are no known cases of unauthorized certificate issuance targeting a CA's own domain, missing records render mandatory CAA checks ineffective for self-protection.

Six of the 22 CAs with no limited domain had voted in favor of Ballot 187 in 2017: GoDaddy, HARICA, GDCA, SHECA, CFCA, and Buypass. Note that while the ballot required CAs to check CAA records for customers, it did NOT obligate them to publish records for their own domains.

Check Your Own CAA Record

Look up your domain's CAA record using dig:

dig CAA yourdomain.com +short

An empty response indicates no CAA record exists (provided the query returns a NOERROR or NXDOMAIN status). Omit +short to view the full response code, as network failures also return blank output. For subdomains, check parent domains as well, as lookups climb the DNS tree.

Recommended CAA Configuration

A standard CAA record specifies your authorized CAs and contact reporting:

yourdomain.com.  CAA  0 issue "letsencrypt.org"
yourdomain.com.  CAA  0 iodef "mailto:security@yourdomain.com"

• Authorize every active CA: Include third-party CAs used by your CDN or cloud provider; otherwise, future certificate renewals will fail.
• Use issuewild only when needed: Standard issue tags cover wildcard certificates automatically. Use issuewild only if wildcard issuance requires distinct rules.
• Set an iodef address: CAs may send reports to this address whenever an unauthorized issuance request is rejected.

---

We are curious: have you looked at your domain's CAA record recently?

References

1. IETF — RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record (November 2019)
2. CA/Browser Forum — Ballot 187 – Make CAA Checking Mandatory (effective 8 September 2017)
3. CA/Browser Forum — Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, v2.3.0, §4.2.2.1
4. CCADB — Resources: All Certificate Records and All CAA Identifiers reports (retrieved 2026-09-28)
5. Scott Helme — Top 1 Million Analysis – June 2026: The State of Crypto
6. Google — Chrome Root Program Policy