I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use 0 issue "comodoca.com" and Certbot would use 0 issue "letsencrypt.org". I need a way to look up what to use for the quoted value when it is not known.

I know that online CAA record generators exist but the CA I use is not listed. Is there a way to look this up online, or extract the value from one of the certificates in the trust chain?

In this instance, I'm trying to learn what to use for Amazon CloudFront (now that Route 53 supports CAA) but I would like to know how to find this value for any issuer. A CLI solution using openssl would be great but an online list is fine also.

EDIT: Checking CAA records becomes mandatory for CA's two weeks from today, and comparing this incomplete list suggested in responses against Mozilla's list of CA's shows a huge discrepancy. For domain owners who wish to publish CAA records today and selectively whitelist trusted CA's, is there no reference material online?


1 Answer 1


The best way I can think of is asking the CAA record of issuers' domain. Most likely they have it setup for their own domains. I tried it with a few and it seems to work for some.

$ dig caa comodo.com
comodo.com.     1013    IN  CAA 0 issue "comodoca.com"
$ dig caa symantec.com
symantec.com.       3599    IN  CAA 0 issue "symantec.com"
$ dig caa digicert.com
digicert.com.       3599    IN  CAA 0 issue "digicert.com"

vcjones also pointed out there is a list maintained by Mozilla here.

Apart from these, your best bet is probably asking the CA what value they need in this field.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.