DNS CAA resource record check

After creating a CAA record authorizing DigiCert to issue TLS/SSL and Secure Email (S/MIME) certificates for the domain, you have effectively deauthorized all other Certificate Authorities (CAs) from issuing a certificate for that domain. The only way to authorize another CA to issue certificates for that domain is to create another CAA record authorizing that CA.

In this way, CAA records enable precise control over the domain's certificate issuance. This control prevents unauthorized Certificate Authorities from issuing certificates for your domain.

Items to note:

Below are valid CAA RR values that you can currently use in your CAA records to authorize DigiCert to issue your TLS/SSL certificate:

All values listed above are equivalent. In other words, you can use any of these values to allow DigiCert to issue TLS/SSL certificates for all the DigiCert certificate brands.

Do you use or are you planning to create DNS CAA records for your domains? Make sure your records are up-to-date and do what you need them to do.

DigiCert recommends checking your domains' existing CAA records before you order TLS/SSL and Secure Email (S/MIME) certificates. Verify that you have the records for each CA authorized to issue these certificates for your domains. We also recommend understanding the process before creating new DNS CAA records for a domain. Do not let a misconfigured CAA record accidentally prevent a CA from issuing a critical certificate.

See Edit a domain's CAA resource record.

A CAA resource record consists of a single-byte flag and a tag-value pair referred to as a property. For TLS certificates, RFC 6844 sections 3, 5.1. For S/MIME certificates, see RFC 9495 section 3.

The flag is an unassigned integer between 0-255. The tag in the tag-value pair may consist of US-ASCII letters and numbers, while the value is an octet string representing the value of the tag-value property.

Use this property tag to authorize a CA, such as DigiCert, to issue S/MIME certificates for yourdomain. When processing an S/MIME certificate order, the CA queries the mailbox domain's DNS for CAA records containing the "issuemail" property tag. The CA can only issue the S/MIME certificate for yourdomain if they find an "issuemail" property tag for the yourdomain authorizing them to issue an S/MIME certificate.

To authorize multiple CAs to issue S/MIME certificates for yourdomain, you must create a unique CAA record for each CA.

yourdomain CAA 0 issuemail "digicert.com"
yourdomain CAA 0 issuemail "ca2.example.com"

Use this property tag to authorize a CA, such as DigiCert, to issue certificates for yourdomain and *.yourdomain. When processing a certificate order for yourdomain or *.yourdomain, the CA queries the domain's DNS for CAA records containing the "issue" property tag. If the CA finds only an "issue" property tag and that tag that authorizes them to issue a certificate for the yourdomain, they can issue a certificate for yourdomain and *.yourdomain.

To authorize multiple CAs to issue certificates for yourdomain and *.yourdomain, you must create a unique CAA record for each CA.

yourdomain CAA 0 issue "digicert.com"
yourdomain CAA 0 issue "ca2.example.com"

Use this property tag to authorize a CA, such as DigiCert,  to issue a certificate for *.yourdomain. When processing a certificate order for *.yourdomain, the CA queries the domain's DNS for CAA records containing the "issuewild" property tag.

To authorize multiple CAs to issue certificates for *.yourdomain, you must create a unique CAA record for each CA.

yourdomain CAA 0 issuewild "digicert.com"
yourdomain CAA 0 issuewild “ca2.example.com”

The "issuewild" property tag authorizes a CA to issue a certificate for a *.yourdomain, *.sub.yourdomain, and *.sub.sub.yourdomain. It does not specifically authorize or prevent a CA from issuing a certificate for yourdomain, sub.yourdomain, and sub.sub.yourdomain.

When correctly used, the "issuewild" property can be an effective tool for creating certificate issuance policies.

For example, you create three "issue" CAA records for yourdomain. Later, you decide you only want one of those CAs to issue certificates for *.yourdomain. So, you create an "issuewild" CAA record authorizing that specific CA to issue a certificate for *.yourdomain. All three CAs can continue to issue certificates for yourdomain, but now only one CA can issue a certificate for *.yourdomain.