What is a CAA record; why does it matter when obtaining certificates with ACME?

Short answer

A CAA (Certification Authority Authorization) record states which CAs can issue certificates for a domain (RFC 8659); e.g. example.com. CAA 0 issue "letsencrypt.org". A CA checks this record before issuing a certificate: if the domain has a CAA record and the CA is not in the list, the certificate is not issued; if there is no CAA record at all, any CA can issue one. In TR7, when a certificate is obtained with ACME, an info box below shows, according to the Acme.sh Server selection in the certificate form, the CA that must be in the CAA record: letsencrypt.org for letsencrypt, sectigo.com for zerossl, pki.goog for google, ssl.com for sslcom. If the DNS of the domain is on TR7 GTM, CAA is also published as a record by selecting it from the Record Type list.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → SSL/TLS Certificates → Add → ACME.SH	The info box under Acme.sh Server	Showing the CA name that must be in the CAA record for the selected ACME server
GTM → GTM Services → service name → Records → Add	Record Type = CAA; the value as text in the Record cell (e.g. 0 issue "letsencrypt.org")	Publishing the CAA record in the zone on GTM
Load Balancer → Profiles → Health Checks (DNS)	DNS Record Type = CAA	Checking the DNS server with a CAA query
GTM → GTM Services → service name → Dashboard → Query Types	CAA Queries panel	Monitoring the CAA queries of CAs and other clients

Structure of the CAA Record

Part	Example	Meaning
Flags	0	128 is the critical flag; for a critical record with an unrecognized tag, the CA does not issue
Tag	issue / issuewild / iodef	Single-name certificate / wildcard certificate / violation reporting address
Value	"letsencrypt.org"	The domain of the allowed CA or the reporting address

• For a wildcard certificate, if there is an issuewild tag, only that tag is taken into account; otherwise issue applies.
• A wildcard certificate with ACME requires DNS-01 validation; the validation text is published with a TXT record (What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?).

Common Misconceptions

• "A CAA record makes the certificate more secure." CAA limits only which CA can issue certificates; it does not change the certificate itself.
• "The info box says that a CAA record is mandatory." The info box shows the CA that must be in the CAA record if the domain has one; if there is no CAA record at all, any CA can issue a certificate.
• "If ACME failed, a CAA record must be added." Since any CA can issue a certificate for a domain without a CAA record, adding CAA is not necessary. CAA blocks issuance when the domain has a CAA record that does not contain the selected CA; in this case, the CA name of the selected ACME server is added to the existing record.

How it is done in the documentation

• SSL/TLS Certificates · Acme.sh Server
• Records · The Supported DNS Record Types
• Health Checks · DNS Record Type

Related questions

• Can I get certificates automatically with Let's Encrypt / ACME?
• What are the ACME protocol and Let's Encrypt?
• What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?