What happens if I have no CAA records configured on my domain?

If no CAA records exist, any publicly trusted Certificate Authority in the world is permitted to issue an SSL/TLS certificate for your domain as long as they successfully validate your domain control through standard validation methods.

Can I authorize multiple Certificate Authorities in my CAA records?

Yes. You can create multiple issue and issuewild lines within your DNS zone file, listing a separate record for each authorized CA (for example, one for DigiCert and one for an internal automated system).

What is the difference between flag 0 and flag 128 in a CAA record?

Flag 0 is non-critical, meaning if a CA does not understand an optional extension tag, it can proceed. Flag 128 is a critical flag; if a CA encounters a critical tag it does not understand or support, it must refuse to issue the certificate.

Do CAA records affect my existing active SSL certificates?

No. Implementing or updating CAA records has no impact on currently installed, valid SSL/TLS certificates. They only take effect when a CA performs pre-issuance checks during a new certificate request or renewal.

How long does it take for DNS changes to affect DigiCert validation?

DNS propagation typically takes anywhere from a few seconds to a few minutes depending on your DNS provider's global caching and the TTL value assigned to the CAA record.

How to Configure a DigiCert CAA Record for Domain Security

A DNS Certification Authority Authorization (CAA) record allows domain owners to declare which Certificate Authorities (CAs) are authorized to issue digital certificates for their domain. Without a CAA record, any public CA in the world can issue an SSL/TLS certificate for your website if they successfully validate your domain control. By implementing a strict policy, you prevent unauthorized or compromised CAs from issuing fraudulent certificates for your infrastructure, drastically reducing your exposure to misissuance and machine-identity attacks.

To ensure your current DNS zone is configured properly and to verify existing policies, you can use the CAA Lookup tool on XiaTools to instantly inspect your active DNS records and check if your domain correctly restricts certificate generation.

Understanding CAA Record Syntax and Tags

A CAA record consists of three primary components within your DNS zone file: flags, tags, and values. Understanding how these elements interact is critical to restricting issuance successfully.

The Critical Tags: issue and issuewild

When configuring a record specifically for DigiCert, you will use two main tags:

issue: Controls standard single-domain and multi-domain (SAN) certificate issuance.
issuewild: Controls wildcard certificate issuance (e.g., *.example.com).

If you do not specify an issuewild tag, a CA that is permitted by the issue tag may or may not be able to issue wildcards depending on the CA's internal interpretation of the RFC, so it is always best practice to explicitly define both.

The Value Structure

For DigiCert, the value string typically takes the format of digicert.com. In some specific enterprise integrations or legacy setups utilizing older intermediate platforms, you might see ca.digicert.com or specific validation parameters attached as critical flags or options. However, standard DigiCert public PKI issuance mandates the use of digicert.com.

Tag	Value	Scope	Description
`issue`	`digicert.com`	Standard Certificates	Authorizes DigiCert to issue standard and SAN SSL/TLS certificates for the zone.
`issuewild`	`digicert.com`	Wildcard Certificates	Authorizes DigiCert to issue wildcard certificates (`*.example.com`) for the zone.
`iodef`	`mailto:security@example.com`	Incident Reporting	Optional tag directing CAs to report unauthorized issuance attempts to your security team.

Step-by-Step Guide to Adding a DigiCert CAA Record

Adding these records requires access to your authoritative DNS provider. Whether you use Cloudflare, AWS Route 53, Azure DNS, or a traditional registrar, the process involves creating standard DNS entries.

Step 1: Gather Your Domain Information

Identify the exact root zone or subdomain where you want to restrict issuance. For most organizations, this is the apex domain (e.g., example.com), which automatically covers subdomains unless overridden by a more specific subdomain CAA record.

Step 2: Log In to Your DNS Provider

Log in to your DNS management console. Navigate to your zone file or DNS record management section. (Note: Menu paths and button names vary by provider, often found under "DNS Settings", "Manage Zone", or "Hosted Zones").

Step 3: Create the Issue Record

Add a new DNS record with the following parameters:

Type: CAA
Name / Host: @ (or leave blank for the root domain, or specify a subdomain)
Flags: 0 (Standard non-critical flag. Setting this to 128 makes the tag critical; if a CA does not understand a critical tag, it must refuse issuance).
Tag: issue
Value: digicert.com

Step 4: Create the Issuewild Record

Add a second record to cover wildcard certificates:

Type: CAA
Name / Host: @
Flags: 0
Tag: issuewild
Value: digicert.com

Step 5: Save and Publish Changes

Save your zone file and publish the changes. DNS propagation usually takes anywhere from a few seconds to a few minutes depending on your provider's TTL (Time to Live) settings.

Verifying Your DigiCert CAA Configuration

Once your records are published, verify that they are returning correctly across global nameservers using command-line utilities or online diagnostics.

Using Digi

Run a standard DNS query for CAA records using the dig utility in your terminal:

dig example.com CAA +short

Expected sample output:

0 issue "digicert.com"
0 issuewild "digicert.com"

Using PowerShell

If you are on a Windows environment, use PowerShell to query the DNS records:

Resolve-DnsName -Name example.com -Type CAA

Testing SSL Issuance Authorization via OpenSSL and Curl

While you cannot force a certificate generation test without interacting with the ACME or API endpoints of DigiCert, you can verify that your domain resolves correctly and that your web server is reachable for HTTP-01 or DNS-01 validation challenges:

curl -I https://example.com

Common Mistakes and How to Fix Them

Omitting the Wildcard Tag: Many administrators configure the issue tag but forget issuewild. This allows DigiCert to issue standard certificates, but leaves your wildcard certificate issuance completely unprotected, letting any other CA issue *.example.com certificates.
Incorrect Value Strings: Entering typos such as digicert without .com, or inputting reseller names instead of the root authority string, will cause CAs to reject validation and halt your certificate issuance.
Confusing Flags (0 vs 128): Using a critical flag (128) when you have multiple authorized CAs or when experimenting can cause unexpected issuance failures if a supporting CA misinterprets the syntax. Stick to 0 unless you explicitly want to block all non-listed CAs strictly under RFC rules.
Forgetting Subdomain Inheritance: CAA records inherit down the tree. If you set a record on example.com, it applies to www.example.com. However, if you set a record on sub.example.com, it overrides the parent record entirely, meaning you must restate DigiCert authorization on subdomains if you use them independently.

Quick Checklist for DigiCert CAA Implementation

Identified root domain and required subdomains.
Verified current DNS records using a lookup tool.
Created the 0 issue "digicert.com" record.
Created the 0 issuewild "digicert.com" record.
Confirmed propagation via dig or PowerShell.
Tested certificate renewal pipeline with DigiCert.

How to Restrict SSL Issuance Exclusively to DigiCert Using CAA