Generate DNS CAA records to control which Certificate Authorities can issue certificates for your domain.
CAA Record Generator formats a Certificate Authority Authorization policy as a DNS CAA record. You provide the flags, property tag, and CA issuer identifier, and it produces the corresponding record text for a DNS zone or provider form. A common surprise concerns wildcard certificates: if the applicable CAA record set contains any issuewild property, wildcard authorization is determined by issuewild rather than issue. The generated text is only a policy declaration; it does not publish the record or change DNS.
A concrete input and expected output from the current implementation.
Input
Flags: 0 Tag: issue Value: letsencrypt.org
Expected output
CAA 0 issue "letsencrypt.org"
The flags value is 0, issue selects ordinary certificate issuance policy, and letsencrypt.org is the CA issuer identifier. The result identifies that CA as an authorized issuer under the applicable CAA policy.
Each generated line uses CAA's three RDATA fields: an 8-bit flags value, a property tag, and a property value. For issue and issuewild, the property value starts with the CA's issuer-domain-name and can include semicolon-separated parameters. A flags value of 0 sets no issuer-critical bit, which is the usual starting choice.
CAA policy is evaluated as a record set, not as one record in isolation. Multiple issue records can authorize multiple issuers. If the requested name has no CAA record set, evaluation proceeds toward its parent labels and stops at the first CAA record set found. A child-level policy therefore does not merge with a policy found higher in the DNS tree.
No. CAA communicates issuance policy to certificate authorities that perform CAA validation. It does not revoke certificates already issued, prevent a private or untrusted CA from ignoring public DNS policy, or replace certificate monitoring. The effective policy can also differ from the generated text if the record is published at the wrong name.
Not always. If the applicable record set has no issuewild property, issue also governs wildcard requests. Once at least one issuewild property is present, wildcard authorization comes from issuewild properties, while issue continues to govern non-wildcard requests. Generate both when you want the same CA explicitly authorized for each type.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.