A CAA record lists which certificate authorities may issue certificates for your domain, and from today all of them must check it. With no record, nothing changes; with a forgotten one, renewals can fail.

What changes today

From today, every certificate authority, the organisations that issue the certificates behind HTTPS and the padlock, must check a domain's CAA record before issuing a certificate for it.

A CAA record is a short line in a domain's DNS settings naming the authorities allowed to issue certificates for that domain. If a domain has one and an authority is not on it, that authority must refuse.

If a domain has no CAA record, any authority may issue, exactly as before. That describes most small business domains, and for them nothing changes today.

The exception is the domain with a record that someone added years ago and nobody remembers.

What the record looks like

A CAA record has three parts: a flag, usually 0; a tag, usually issue; and a value naming the authority. A record allowing only Let's Encrypt reads 0 issue "letsencrypt.org".

A domain can have several such lines, one per authority allowed. The records on the main domain also cover its subdomains, such as shop or booking, unless a subdomain has records of its own.

The record lives wherever your DNS is managed: at the registrar, at the host, or at a separate DNS service.

Not every DNS control panel offers CAA as a record type yet, so adding one sometimes means asking the DNS provider to do it.

Why the rule exists

Any certificate authority can issue a certificate for any domain once it has checked that the requester controls it. Occasionally that check has been fooled or done carelessly, and certificates have gone to people who did not control the domain.

A CAA record shrinks the list of authorities that could make that mistake for your domain, from every trusted authority to the one or two you actually use.

Browsers never look at the record. Only authorities check it, at the moment of issuing, so certificates already in place are unaffected.

The standard has existed since 2013, but checking it was optional. Earlier this year the industry body of certificate authorities and browser makers agreed to make it mandatory from today.

Who needs to do anything

For most businesses, the honest answer is nobody. A few situations are worth a check.

The fourth is the one that catches businesses with a record. A hosted store or booking system on a subdomain may use a different authority from the main site, and a record listing only one blocks the other.

How to look up your record

Free DNS lookup pages on the web will show a domain's CAA records if you choose CAA as the record type. Whoever manages your hosting can also check in a few minutes.

An empty answer means there is no record, and nothing needs doing. Any answer at all deserves a look at which authorities it names.

Check the main domain and each subdomain that has its own service behind it, since those are where a mismatch hides.

A worked example

A bookbinder who repairs old books and binds theses also sells handmade journals through a hosted store platform, which runs on a subdomain of her main address.

Last year, when her main site moved to a host that issues free certificates from Let's Encrypt, the developer handling the move added a CAA record naming Let's Encrypt alone, as a precaution.

The store came later. Its platform issues its own certificates through a different authority, and the record on the main domain covers the store's subdomain too.

Until today the platform's authority had no obligation to look. From today it must, and at the store's next renewal it would find its name missing and refuse.

The developer caught it this week while checking the domain ahead of the change, and added a second line naming the store platform's authority, using the value given in the platform's help pages.

Removing the record entirely would also have worked. Keeping it, with both names and a note in the site's records, keeps the protection it was added for.

The forgotten record

Records like this are added for good reasons: a developer following a security checklist, a host setting one up during a certificate purchase, an IT contractor tightening things up.

The trouble starts when the business later changes host or adds a service and nobody remembers the record. The new provider's request is refused, often with an error message that only a technical person reads.

Free certificates are usually valid for ninety days and renew automatically. If a renewal is refused, the site keeps working until the old certificate runs out, then visitors see a full-page security warning instead of the site.

Should a small business add one

Adding a record is optional, and for most small sites the benefit is modest. The certificate mistakes it guards against are rare.

If you add one, list every authority that issues certificates for the domain and its subdomains, and write it down where the next developer will find it.

A record that is maintained is a small safeguard. A record that is forgotten is a future outage with a delay on it.

The counter-case

For the great majority of small business domains, today's change means nothing at all: no record, no change, no action.

Larger organisations with many subdomains and several certificate providers have more to check, and should already know where their records are.

For everyone else: look once, and if there is a record, make sure it names every authority you actually use.

Today's check

  1. Look up your domain's CAA records.
  2. Stop there if there are none.
  3. List every service that issues you certificates.
  4. Compare that list with the record.
  5. Add any missing authority to the record.
  6. Check each subdomain with its own service.
  7. Note the record in your site's documentation.

Step three is the one that takes thought. The main site's certificate is easy to remember; the store, the booking system and the webmail on their own subdomains are the ones a record forgets.

Knowing who really handles your domain helps here, as it does with renewal letters from companies you never used.

Frequently asked questions

What is a CAA record?

A line in your domain's DNS settings naming the certificate authorities allowed to issue certificates for it. Any authority not named must refuse to issue.

What changes on September 8?

From that day every certificate authority must check the record before issuing. Until then checking was optional, so a forgotten record could often sit for years without blocking anything.

Do I need to add a CAA record?

No. Most small business domains have none, and without one any authority may issue as before. Adding one is optional and only worth it if someone will maintain it.

How can a CAA record block a renewal?

If the record names one authority and your host or store uses another, the other must now refuse. The site works until the old certificate expires, then shows a warning.

Does a record cover my subdomains too?

Yes, unless a subdomain has records of its own. A store or booking system on a subdomain using a different authority needs that authority named as well.

How do I check my domain's record?

Use a free DNS lookup page and choose CAA as the record type, or ask whoever manages your hosting. An empty answer means there is nothing to do.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure what your CAA record says?

Give us the domain name and we will read its CAA records and say whether anything needs to change.

Start a Conversation