Quick answer

What is a CAA record and do I need one?

It lists which certificate authorities may issue certificates for your domain. Without one, any authority can, and most domains do not have one.

A CAA record names the certificate authorities allowed to issue for your domain. Without one, any publicly trusted authority may issue a certificate for you, which is the default state for most domains.

What it protects against

Mis-issuance. If somebody convinces a certificate authority to issue for your domain — through a compromised validation path or an administrative error — a CAA record naming only your actual authority means most authorities will refuse before it gets that far.

Is it worth adding

It is a single DNS record and it costs nothing, so yes. It is not urgent for most businesses, and its absence is not a fault. It is one of those gaps that is worth closing while you are already in the DNS panel.

The catch to know about

If you add a CAA record naming one authority and later switch providers, issuance fails until you update it. That is the intended behaviour, and it is why a forgotten CAA record occasionally causes a confusing certificate failure years later.

This is the short version. The full guide covers it properly: read more.

Related

Check yours

Find out where you stand.

The free check answers this for your domain in about ten seconds. No account, no card.

Other quick answers

How do I find out who owns my domain? · Why are my emails going to spam? · What is the difference between my domain, my hosting and my DNS?

All guides