Loading page
About this tool
Generate RFC 8659 CAA records that restrict which certificate authorities may issue TLS certificates for your domain.
This generator builds CAA (Certification Authority Authorization) records as defined by RFC 8659 — DNS records that name the certificate authorities permitted to issue TLS certificates for a domain, using the issue, issuewild and iodef tags with the correct flags octet. Public CAs have been required to check CAA before every issuance since 8 September 2017 under the CA/Browser Forum Baseline Requirements, so a correct record set meaningfully reduces mis-issuance risk. It is for site owners, security teams and anyone completing a security questionnaire that asks for CAA.
Open CAA Record Generator on AltFTool — it loads instantly in your browser.
Provide your input — an image, text, or data.
Let the tool analyze or generate the result.
Review, refine, and reuse the output wherever you need it.
Flags octet, tag names and quoted values come out in valid zone-file form every time.
Pick Let's Encrypt, DigiCert, Sectigo, Google Trust Services and other registered identifiers without looking them up.
Warns when a record set would block all issuance and explains subdomain inheritance.
A CAA record lists which certificate authorities may issue TLS certificates for your domain; any CA not named must refuse the request. Since 8 September 2017, all publicly trusted CAs are required by the CA/Browser Forum Baseline Requirements to check CAA before issuing, so the restriction is enforced industry-wide.
Yes. RFC 8659 has the CA walk up the DNS tree from the requested name and apply the closest CAA record set it finds, so records on example.com govern shop.example.com unless that subdomain publishes its own CAA records.
Any publicly trusted CA may issue for your domain, subject to its normal domain-control validation. CAA is opt-in: an empty record set imposes no restriction, which is why adding one for just the CAs you use is a cheap security win.
Yes — if your CA is not listed, its next validation attempt fails and the renewal is refused, though existing certificates keep working until they expire. Before publishing, confirm the identifier your CA documents (for example ZeroSSL certificates are covered by sectigo.com), and remember the record is cached for its TTL after you fix it.