Engineering, made clearer.Find a tool /
Email & DNS

CAA Record Builder

Build a CAA property that constrains certificate issuance for a domain.

Calculations run in your browser. The tool does not send your inputs to a server.

01Your inputs

Local workspace

Start with the sample below, or enter your own values.

Enter a numeric value using the unit shown in the label.
Enter a numeric value using the unit shown in the label.

02Your result

Your result will appear here. Choose an action after checking your inputs.

A quick guide

How to use this tool

  1. Check the example and the unit beside each input.
  2. Enter your values and choose Build.
  3. Review the result and assumptions, then copy what you need.

Reset example restores the starting values. Clear removes text and number inputs, returns choices to their first valid option, and removes the result.

Reference guide

Explanation and worked examples

issue controls ordinary issuance, issuewild controls wildcard issuance, and iodef supplies an incident-report URL. Confirm the chosen CA domain with that CA.

Use in day-to-day IT work

Review which certificate authorities may issue certificates for a domain.

Checks before applying the result

  • issue also applies to wildcard issuance unless issuewild takes precedence. Review the complete relevant record set, not just one generated line.
  • Confirm the CA identifier and any account or validation parameters with the CA before changing issuance policy.
New to the terminology?
SPF
Sender Policy Framework: authorises sending hosts for a domain used by SMTP.
MTA-STS
A published policy for authenticated TLS delivery to declared MX hosts.
TTL
How long a DNS answer may normally remain cached.

Keep exploring

SPF Record GeneratorEmail Address ExtractorEmail Header AnalyserSPF Record Analyser

How calculations work and where the models stop →