Restrict issuers with a CAA record

You can restrict which certificate authorities (CAs) may issue certificates for your domain with a CAA record in Edge DNS, from Azion Console, the Azion CLI, or the Azion API. The record below, 0 issue "letsencrypt.org" on the apex @, names Let’s Encrypt as the CA allowed to issue for example.com. For every CAA tag and value format, refer to Record types.

Prerequisites

Console

A zone for your domain in Edge DNS. To create one, refer to Create, edit, or delete a zone.
No CNAME record on the name that takes the CAA record. A CNAME blocks every other record type on its name.
The Edit Edge DNS permission. Refer to Teams permissions.
Access to Azion Console. To sign in, refer to Access Azion Console.

CLI

A zone for your domain in Edge DNS. To create one, refer to Create, edit, or delete a zone.
No CNAME record on the name that takes the CAA record. A CNAME blocks every other record type on its name.
The Edit Edge DNS permission. Refer to Teams permissions.
The Azion CLI installed and authorized.

API

A zone for your domain in Edge DNS. To create one, refer to Create, edit, or delete a zone.
No CNAME record on the name that takes the CAA record. A CNAME blocks every other record type on its name.
The Edit Edge DNS permission. Refer to Teams permissions.
A personal token and curl.

Add the CAA record

The record goes on @, the apex, so it covers example.com. Replace example.com with your domain and letsencrypt.org with the CA you allow.

Certificate Manager requests a workload’s certificates from Let’s Encrypt. While it issues certificates for your domain, keep letsencrypt.org in the record. For how it issues and renews them, refer to Issuance and renewal.

Console

To add the record in Azion Console:

Open the Edge DNS page

Access Azion Console > Edge DNS.

Open the zone's Records tab

On the Zones page, select the row of the zone, then select the Records tab.

Select + Record

The Create Record drawer opens.

Enter the apex name

In Name, enter @. The Console adds the domain for you, so never type the domain.

Select the CAA type

In Record Type, select CAA - Certification Authority Authorization.

Keep the TTL

Keep TTL (seconds) at 3600.

Enter the value

In Value, enter 0 issue "letsencrypt.org". To allow another CA, add its value on a new line.

Select Save

The Console shows Edge DNS Record has been created, and the CAA record appears in the Records table.

CLI

To add the record with the Azion CLI, save the record as caa.json:

{"name":"@","type":"CAA","rdata":["0 issue \"letsencrypt.org\""],"ttl":3600}

Then create the record from the file. Replace <zone-id> with the ID of your zone:

azion create dns-record --zone-id <zone-id> --file caa.json

The command prints the ID of the record:

Created DNS record with ID 100782

The zone holds the CAA record. Pass the value through --file: --rdata refuses a value that contains double quotes.

API

To add the record with the Azion API, send a POST request to the zone’s records endpoint. Replace <zone-id> with the id of your zone:

Shell

01curl -X POST https://api.azion.com/v4/workspace/dns/zones/<zone-id>/records \

02 -H "Authorization: Token [TOKEN VALUE]" \

03 -H "Content-Type: application/json" \

04 -d '{"name":"@","type":"CAA","rdata":["0 issue \"letsencrypt.org\""],"ttl":3600}'

A 201 returns the record:

JSON

01{

02 "state": "executed",

03 "data": {

04 "id": 100180,

05 "description": "",

06 "name": "@",

07 "ttl": 3600,

08 "type": "CAA",

09 "rdata": ["0 issue \"letsencrypt.org\""],

10 "policy": "simple",

11 "weight": 255

12 }

13}

The zone holds the CAA record. Each CA you allow is one string in rdata, and the double quotes around the CA’s name are escaped inside the JSON string.

A CAA record on a name that holds a CNAME is refused with 19018 CNAME Record Already Exists For Domain. A CNAME on another name of the zone does not block it. Like any change, the record can take a few minutes to reach every nameserver. For how answers are cached, refer to How it works.

Check the record

To ask Azion’s nameserver for the record directly, without your resolver’s cache, replace example.com with your domain:

dig +short @ns1.aziondns.net example.com CAA

The answer lists the values of the CAA record. If it lists nothing, refer to Troubleshooting.

Next steps

Issuance and renewalHow Azion requests a Let's Encrypt certificate for a workload's domains.Add the Let's Encrypt TXT recordAdd the TXT record a DNS-01 challenge checks.Record typesThe issue, issuewild, and iodef tags, and more CAA values.Add, edit, or delete a recordChange or remove the CAA record later.