Jul 7, 2025

CAA Checking for SSL Certificates

What is CAA Checking? 

CAA (Certificate Authority Authorization) Checking enables domain owners to control or restrict which CAs can issue certificates for a particular domain name. By configuring the DNS CAA record, domain owners can limit which Certification Authorities are authorized to issue certificates to that domain name.  All CAs that issue publicly trusted TLS certificates are required to check DNS for CAA records prior to issuance. 

How does it work? 

Domain owners that want to limit issuance to certain CAs can create DNS CAA records that list the CAs they permit to issue certificates to the domain. If a domain has a DNS CAA record, only the CAs listed in the record(s) are allowed to issue certificates for that domain. If no DNS CAA record is present, any CA is allowed to issue certificates for that domain name. 

CAs must validate each SAN in the certificate just prior to issuance.  The process starts with the FQDN in the certificate e.g., www.eu.example.com, and then works the way up the hierarchy, (to eu.example.com and then to example.com for this domain), looking for CAA records.  As soon as a DNS CAA record is found, the CAA records for that domain are processed and the CAA checking ends.  Customers can restrict at the higher domain level, example.com, or at lower levels as needed, eu.excample.com. 

If the CA encounters a domain that has a CNAME record, the CA will follow that and look for CAA records there.

GlobalSign processes the issue and issuewild tags. 

Detailed CAA Processing Logic 

For each DNS Name SAN in the certificates request we perform the following: 

• Look for CAA records using the SAN in the request 

• If the lookup finds a CNAME record, we follow that and process the CAA records per the logic below. We will follow up to 10 CNAMEs before ending in an error.  

• If there are no errors and no CAA records with issue tags were returned during the CNAME chasing, we prune the left most node and proceed using that value. 

• We continue doing this until we are down to the Base Domain 

Error scenarios that block issuance: 

• If the zone is DNSSEC signed and we encounter a timeout,  SERVFAIL or refused error 

• If we get SERVFAIL or refused while trying to determine if the zone is DNSSEC signed 

• If the DNS response is truncated because of too many CAA records, and we haven’t found “globalsign.com” in the CAA issue records, we return a "truncated DNS response" error message 

Errors that we conditionally permit issuance:

• If the zone is not DNSSEC signed, we will permit issuance even if we encounter a timeout or SERVFAIL error 

We may cache CAA records for up to an hour, so ever after they are updated it may take an hour for our system to obtain updated records. 

Wildcard SANs 

Customers may wish to restrict the issuance of wildcard SANs differently than other SANs.  When the issue tag is used, that will restrict issuance of all SAN types, but if there is a desire to restrict wildcard SANs differently, then the issuewild tag should be used.   

When validating a wildcard SAN, the process starts the same as any other SAN.  For example, if the SAN is *.eu.example.com the check will start with eu.example.com.  If an issue tag is found for globalsign.com (and there are no issuewild tags), the CAA check will end successfully.  If there is an issue tag for globalsign.com and an issuewild tag for one or more CAs other than GlobalSign, then the CAA check will fail. 

How to create CAA records 

There are various different ways to modify your DNS CAA records.  Please refer to the following guides below:  

1. How to add DNS CAA record in a hosted DNS 

2. How to add DNS CAA record to a DNS zone file 

Your DNS CAA record should contain "globalsign.com" as shown below.  

Making your DNS publicly available 

Our CAA validation process requires that we find the presence of a DNS entry for the FQDN or in the path up to the Base Domain . We understand under certain circumstances that security or policy prohibits making your A, AA, and MX records public and only enabling them to support the currently annual domain validation (which will being reduced to as little as 47 days in the coming years).  At a minimum, we must be able to determine if the DNS zone is DNSSEC signed or not. 

If you are unable to make your DNS records public to support frequent issuance, we recommend using a split-horizon approach where internal and external network accesses the same domain name with different IP addresses.  It’s also possible to provide different values depending on the source IP address.   There are numerous articles on split horizon, also referred to as split-view or split-brain, that can guide you towards an approach that balances your security needs with the ability to provide a DNS entry for your domain for successful CAA validation. 

Common Errors