CAA Record Generator
Free online CAA record generator. Outputs BIND zone file, Cloudflare dashboard, and AWS Route 53 change-batch JSON formats. No signup required.
Loading tool...
What is CAA Record Generator?
A CAA record generator helps you compose valid DNS CAA (Certification Authority Authorization) records, defined in RFC 8659. CAA lets you lock down which certificate authorities may issue TLS certificates for your domain, preventing unauthorized or unwanted issuance. This tool lets you add issue entries (with optional CA parameter strings), restrict wildcard issuance via issuewild, add iodef violation-report addresses, and export the result as a BIND zone file, Cloudflare dashboard values, or a Route 53 change-batch JSON.
Key Benefits
- Restricts certificate issuance to trusted CAs only
- Preset list of 12 popular certificate authorities
- Automatic quote and backslash escaping in parameter strings
- Multiple export formats for BIND, Cloudflare, and Route 53
Common Use Cases
- •Hardening domain certificate policy
- •Meeting CA/Browser Forum compliance requirements
- •Preventing unauthorized certificate issuance
- •Auditing existing CAA records during DNS reviews
How to Create CAA Records
- Enter your domain: Type the apex domain the CAA records will be published for, e.g. example.com.
- Pick your CAs: Choose the certificate authorities allowed to issue certificates from the preset list, or enter a custom CA domain.
- Set issuewild and reporting: Optionally restrict wildcard issuance with issuewild and add iodef report addresses (mailto: or https:).
- Copy to your DNS: Copy the BIND, Cloudflare, or Route 53 output and publish it at your DNS provider.
Key Features
- issue, issuewild, and iodef tag support per RFC 8659
- Preset list of 12 popular CAs (Let's Encrypt, DigiCert, Sectigo, GlobalSign, ACM, pki.goog…)
- CA parameter strings with automatic quote/backslash escaping (validationmethods, accounturi)
- Four output formats: BIND zone file, Cloudflare dashboard table, Route 53 JSON, and plain records
- Live validation for domains and mailto:/https: iodef URIs
- One-click copy and download of the finished records
Frequently Asked Questions
What is a CAA record?
CAA (Certification Authority Authorization), defined in RFC 8659, is a DNS record that lets a domain owner declare which certificate authorities (CAs) are allowed to issue TLS certificates for the domain. CAs must check it before issuing.
What is the difference between issue and issuewild?
issue controls which CAs may issue certificates for the exact domain (and non-wildcard names). issuewild applies specifically to wildcard certificates (*.example.com). If issuewild is absent, the issue policy applies to wildcards too.
What does the iodef tag do?
iodef specifies where CAs should send violation reports when someone requests a certificate that breaks your CAA policy — a mailto: or https: URI. It is optional but recommended for visibility.
Which DNS providers support CAA records?
All major providers do: Cloudflare, Route 53, Google Cloud DNS, Azure DNS, GoDaddy, and BIND-based name servers. This tool generates the BIND zone-file syntax, the dashboard value string, and a Route 53 change-batch JSON for you.