CAA Record Inspector & Policy Generator
Enforce strict cryptographic certificate boundaries. Inspect active RFC 8659 CAA DNS records, prevent unauthorized SSL issuance across tier-1 CAs, and generate hardened policies for Cloudflare, Route 53, and BIND.
Hardened CAA Policy Builder
Select the Certificate Authorities permitted to issue certificates for your domain and configure incident reporting.
Frequently Asked Questions
Why are CAA DNS records critical for domain security?
Without a CAA record, any of the hundreds of publicly trusted Certificate Authorities worldwide can issue an SSL/TLS certificate for your domain. CAA records (RFC 8659) strictly restrict issuance to only the specific CAs you explicitly authorize.
Are Certificate Authorities legally required to check CAA records?
Yes. Since September 2017, the CA/Browser Forum Baseline Requirements mandate that all publicly trusted Certificate Authorities must inspect DNS CAA records prior to issuing any certificate.
What is the difference between the issue and issuewild tags?
The issue tag authorizes a CA to issue standard single-name and multi-domain certificates. The issuewild tag specifically governs wildcard certificate issuance (such as *.example.com). Setting issuewild to a semicolon (";") blocks all wildcard certificates.
What does the iodef property tag do in a CAA record?
The iodef tag specifies an email address or HTTP endpoint where compliant Certificate Authorities must send security incident reports if an unauthorized party attempts to request a certificate for your domain.