SecuryBlackCAA Record Generator
Choose which certificate authorities can issue certificates for your domain and generate the DNS record ready to paste.
Allowed certificate authorities
Generated CAA record
tudominio.com. IN CAA 0 issue "letsencrypt.org"Do I already have CAA?
What are CAA DNS records and why are they needed?
A CAA (Certification Authority Authorization) DNS record explicitly specifies which Certificate Authorities (like Let’s Encrypt or DigiCert) are allowed to issue SSL/TLS certificates for your domain.
If an attacker compromises an unauthorized CA, that CA is required by industry standards to deny certificate issuance if not listed in your CAA record.
CAA Records FAQs
Is configuring a CAA record mandatory?
It is not mandatory for regular web traffic, but it is an essential security best practice to prevent fraudulent certificate issuance.
What happens if I use Let’s Encrypt without a CAA record?
If no CAA record exists, any recognized Certificate Authority is allowed to issue certificates for your domain.
And the rest of your domain?
CAA is just one piece. Certificate, headers, email, ports: check it all free in a minute.