Hosting and network Recommended

Choose who may issue your certificates

Publish DNS CAA records. They list which certificate authorities may sign certificates for your name. All others must refuse.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Add 0 issue "letsencrypt.org" for your authority. Add 0 issuewild ";" if you need no wildcard certificates, and 0 iodef "mailto:…" for reports.

Example

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

dig +short CAA example.com

How to check

A DNS query for CAA returns your records.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/caa-records.