---
title: "Choose who may issue your certificates · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network/caa-records
updated: 2026-10-20
licence: "All rights reserved"
---

# Choose who may issue your certificates

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Rule: Publish DNS CAA records. They list which certificate authorities may sign certificates for your name. All others must refuse.
- How: Add `0 issue "letsencrypt.org"` for your authority, and one line for each other authority you use, such as your CDN's. Add `0 issuewild ";"` if you need no wildcard certificates, and `0 iodef "mailto:…"` for reports. To go further, tie issuing to your own ACME account with `accounturi` (RFC 8657).
- Check: `dig +short CAA example.com` returns your records, and a certificate renewal still succeeds.

Example:

```dns
example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"
```

```sh
dig +short CAA example.com
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/caa-records`.

- Previous: [Renew certificates automatically](https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal)
- Next: [Sign your DNS](https://agentwranglers.se/playbook/website/hosting-and-network/dnssec)
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)