Check certificate permissions with CAA

Read flags, tags and values without confusing permissions with issued certificates.

Read the authorization intent

CAA can specify which certificate authorities are allowed to issue certificates for a domain. Its text normally includes flags, a tag and a value. The issue and issuewild tags concern ordinary and wildcard issuance. Check your certificate provider’s instructions before making changes.

Permissions are not a certificate inventory

CAA is not a certificate transparency log and cannot tell you whether a website’s current certificate has expired. No CAA answer does not mean HTTPS is absent; a CAA answer does not prove that the server is using a valid certificate.

Review it when changing providers

Before moving automated certificate issuance to a new service, check existing CAA authorization against that service’s requirements. Allow caches to refresh after a change, then follow the new provider’s issuance process. Do not delete an unfamiliar record without checking its purpose.

This guide explains public DNS responses. Before changing production settings, check the documentation for your current domain and hosting providers.