Reading a CAA set — DNS Security Practitioner

Reading a CAA set

After this lesson you can

Say exactly which authorities may issue for a name, given a set of records.

Assumes you have read Signatures expire.

CAA tells certificate authorities which of them may issue for a name. A CA is required to check it at issuance and to refuse if it is not listed — which makes it the one control a domain owner has over the certificate ecosystem.

The three properties

Property	Constrains
`issue`	Who may issue any certificate for this name.
`issuewild`	Who may issue a wildcard. If absent, `issue` governs wildcards too.
`iodef`	Where a CA should report a request it refused. Rarely published and rarely acted on.

Four live sets

$ dig +short CAA google.com

0 issue "pki.goog"

Checked 2026-09-15. One authority — their own.

$ dig +short CAA github.com

0 issue "digicert.com"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "sectigo.com"
0 issuewild "digicert.com"
0 issuewild "letsencrypt.org"
0 issuewild "sectigo.com"

Checked 2026-09-15. Four issuers, three of which may issue wildcards.

GitHub’s set is worth reading carefully. GlobalSign may issue an ordinary certificate and not a wildcard, because it appears under issue and not under issuewild. Publishing any issuewild overrides issue for wildcards entirely.

$ dig +short CAA wikipedia.org

0 issue "letsencrypt.org"
0 issue "pki.goog"
0 iodef "mailto:dns-admin@wikimedia.org"

Checked 2026-09-15. One of the few published iodef addresses.

How a CA finds the record

Issuing for  api.eu.example.com:

  1. CAA at api.eu.example.com   found? use it. stop.
  2. CAA at eu.example.com       found? use it. stop.
  3. CAA at example.com          found? use it. stop.
  4. no record anywhere          -> any CA may issue

It climbs until it finds a set, and the first set it finds is the whole answer. A record at a subdomain therefore replaces the apex policy for that name rather than adding to it — which is how a permissive subdomain record quietly undoes a strict apex one.

An empty issue value forbids everything

0 issue ";" means no authority may issue. It is the correct record for a name that should never have a certificate, and it is also what you accidentally publish if a provider interface treats an empty field as a valid value.

Knowledge check

A domain publishes issue for three CAs and issuewild for one. Which CAs may issue a wildcard?

Only the one named in issuewild — publishing any issuewild overrides issue for wildcards entirely.
All four — issuewild adds to the issue list.
The three in issue, since issuewild is advisory.
None — a wildcard requires both properties to name the same CA.

Correct — Only the one named in issuewild — publishing any issuewild overrides issue for wildcards entirely. issue governs wildcards only when no issuewild is present at all. Once one exists, it is the complete list for wildcard issuance, which is how GitHub permits GlobalSign an ordinary certificate and not a wildcard.

Not this — All four — issuewild adds to the issue list. They do not combine. issuewild replaces issue for the wildcard case.

Not this — The three in issue, since issuewild is advisory. Both properties are binding on a conforming CA.

Not this — None — a wildcard requires both properties to name the same CA. No such requirement exists. The CA named in issuewild may issue the wildcard.

Last reviewed 2026-09-15