# How do you set up CAA records for your domain? > Set up CAA records under RFC 8659 with issue, issuewild and iodef tags so only the certificate authorities you name can issue for your domain. - URL: https://wardmint.com/guides/set-up-caa-records/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A CAA record is a DNS entry that tells certificate authorities whether they may issue a certificate for your name. It takes minutes to add and removes an easy step from a hijacker's plan. **Quick answer — How do you set up CAA records for your domain?** Add a CAA record at the domain apex in the form `0 issue "ca.example.net"`, naming each certificate authority allowed to issue, then add `issuewild` for wildcards and `iodef` for violation reports, as RFC 8659 defines. **Wardmint**'s free DNS supports CAA records on every domain, and a .com costs $12.49/year, with the same record set at no added cost. ## CAA tags and what each one does | Tag | Example record | Effect | | --- | --- | --- | | issue | 0 issue "ca.example.net" | Allows that issuer to issue certificates for the name | | issue (empty) | 0 issue ";" | Allows no issuer to issue for the name | | issuewild | 0 issuewild "ca.example.net" | Applies only to wildcard names and overrides issue for them | | issuewild (empty) | 0 issuewild ";" | Forbids wildcard certificates while normal ones stay allowed | | iodef | 0 iodef "mailto:security@example.com" | Gives a URL or address where a CA can report a request that broke the policy | ## What is a CAA record? **A CAA record is a DNS resource record, defined in RFC 8659, that lets a domain owner list which certificate authorities may issue certificates for the name.** Its presentation form is CAA, then a flags value, a tag and a value. The flags field is one octet, and bit 0 is the issuer critical flag, written as 128 when set; almost every record uses 0. The tag is a word such as issue, and the value is a string, often quoted. Before issuing, a certificate authority looks up the CAA records of the name it has been asked to certify. If it finds none at that name, it climbs to each parent label in turn and stops at the first set of CAA records it finds, according to RFC 8659; it never checks the root. If no set exists anywhere, issuance is not restricted. A record on the apex therefore covers every subdomain that has no record of its own. A useful definition for quotation: a CAA record is a public, DNS-level allow-list of the certificate authorities permitted to issue for a domain. ## Why do crypto projects need CAA records? **Because a DNS hijacker needs a valid certificate to make the fake front end look genuine, and CAA makes that step harder.** Blockaid tracked five front-end compromises between 16 and 23 February 2026 and noted one fingerprint: SSL certificates issued the same day as the DNS change. In the Nerochain case, wildcard certificates were issued for the project's domain. According to Wardmint's reading of the Blockaid report on 12 November 2026, five compromises in seven days produced at least one repeated attacker habit that a CAA record can interfere with. If your records allow only your own authority, an attacker who changes DNS must also change the CAA records before another authority will sign, and that extra change is a signal you can watch. CAA is not a defence on its own. An attacker who controls your DNS can edit CAA records too, and RFC 8659 states that CAA does not affect certificates already issued. Treat it as a layer next to the controls in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"), and pair it with alerts from [certificate transparency monitoring](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"). ## What is the exact syntax of issue, issuewild and iodef? **Each record has the shape name, class, CAA, flags, tag, value, and the value follows the tag exactly as RFC 8659 specifies.** The issue tag names the issuer domain allowed to issue. The issuewild tag applies only to wildcard names, and when present it overrides issue for wildcard requests. The iodef tag gives a reporting URL using mailto, http or https. To forbid all issuance for a name, publish an issue record with an empty issuer, written as a semicolon in quotes. For a normal domain, publish one issue record per authority you use, and one issuewild record if you want wildcards controlled separately. Take the exact issuer identifier from your authority's documentation, since it is a domain name that the authority chooses. *A working CAA set for a domain with one authority* ```dns example.com. 3600 IN CAA 0 issue "ca.example.net" example.com. 3600 IN CAA 0 issuewild ";" example.com. 3600 IN CAA 0 iodef "mailto:security@example.com" ``` *A CAA record that allows no certificate at all* ```dns parked.example.com. 3600 IN CAA 0 issue ";" ``` ## How do you set up CAA records on a defensive domain? **On a defensive domain that only redirects, allow the one authority that serves the redirect, or forbid issuance if nothing answers over HTTPS.** A domain that is parked with no web service has no need for a certificate, so `0 issue ";"` removes the option for anyone else. A defensive domain that forwards visitors to your main site over HTTPS needs a certificate for that, so it must allow the authority that provides it. Start from the plan in [how to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"), then add the matching CAA records. On Wardmint, free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13), so the records are added in the same client area as the forwarding. A project that holds the core set of .com, .net, .org, .io, .xyz, .app, $128.94 a year, applies the same CAA set to all six names. ## How to set up CAA records in six steps 1. **List the authorities you use** — Check which certificate authority issues for your main site, your docs and any wildcard, and note the issuer identifier each one publishes. 2. **Check existing records** — Run dig CAA example.com +short to see whether a CAA set already exists at the apex or on a parent name. 3. **Add an issue record per authority** — At the apex, add a CAA record with flags 0, tag issue and the authority's identifier in quotes. 4. **Control wildcards separately** — Add an issuewild record naming the authority that may issue wildcards, or a semicolon in quotes if you want none. 5. **Add a reporting address** — Add an iodef record with a mailto address that a person reads. 6. **Test, then watch issuance** — Run dig CAA again, request or renew one certificate to confirm issuance still works, and set a Certificate Transparency alert for your name. ## What mistakes break certificate issuance? **The usual mistake is naming an authority you forgot you use.** Hosting platforms, content delivery services and email providers sometimes request their own certificates for your subdomains. If your CAA set omits them, renewal fails, often silently, until a certificate expires. List every service that serves a name under your domain before you publish. A second mistake is an issuer identifier that is misspelled, which blocks everyone, including the authority you meant to allow. Test with a real renewal. A third is forgetting that a CAA record higher up applies to a subdomain with none of its own, so a restrictive apex can block a subdomain's renewal. Changing the record never revokes a certificate that already exists. If an unexpected certificate has been issued, treat it as an incident and follow the steps in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports, including help with CAA records. ## Questions about CAA records ### Does a CAA record cancel certificates already issued? No. RFC 8659 says CAA reflects current authorisations only, so changing it does not affect certificates that were issued before. ### Do I need a CAA record on every subdomain? No. A certificate authority climbs to the parent names until it finds a CAA set, so one set at the apex covers subdomains without their own. ### What does a semicolon mean in an issue record? It is an empty issuer, and it forbids all issuance for that name. Use it on domains that serve no HTTPS. ### Can an attacker change my CAA records? Yes, if they control your DNS or your registrar account. That is why CAA works alongside a locked account and certificate alerts. ### Does Wardmint support CAA records? Yes. Wardmint's free DNS hosting supports CAA records, and support helps with them: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. **In summary** - A CAA record lists the certificate authorities allowed to issue for a domain (RFC 8659). - Syntax: flags, tag, value, for example 0 issue followed by the authority in quotes. - Use issuewild for wildcards and iodef for violation reports; a semicolon forbids issuance. - A CA climbs to parent names until it finds a CAA set; the root is never checked. - CAA does not affect certificates already issued. - Blockaid saw certificates issued the same day as the DNS change in February 2026 hijacks. - Wardmint's free DNS supports CAA records on every domain. ## Sources 1. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html) — IETF / RFC Editor (read 2026-11-12) 2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.