Setting up CAA on Cloudflare: the 2-minute job almost nobody has done

Last week I ran a scan across several hundred Australian organisation domains - small businesses, mid-sized firms, universities, government agencies, multinationals. One of the checks was a DNS record called CAA. At the small-business end, 1 domain in 20 had it. The multinationals - companies with security teams, budgets, and board papers about cyber risk - managed 1 in 4.

That number has been sitting with me all week, because CAA is not hard. If Cloudflare runs your DNS, it is a 2-minute job. I want to walk you through what the record does, why almost nobody sets it, and why the one good excuse for skipping it no longer applies on Cloudflare.

The default is "anyone"

Here is the part most business owners never hear. Any publicly trusted certificate authority in the world - and your browser trusts well over a hundred of them - is allowed to issue a certificate for your domain. Not just the one your website actually uses. Any of them. That is the default, and it stays the default until you publish a record saying otherwise.

CAA - Certificate Authority Authorization - is that record. It is a line in your DNS that says: only these named authorities may issue certificates for this domain. A conforming authority has to check it before issuing, and if it is not on your list, it has to refuse.

Why care? Certificates are how browsers decide your site is your site. Mis-issued certificates are rare, but they are not theoretical - they happen through compromise, process failure, or someone convincingly pretending to be you. CAA does not make you bulletproof. It shrinks the issuing surface from "every authority on earth" to "the ones I actually use". There is also a third kind of CAA record, tagged iodef, which adds a reporting address: if anyone asks an authority to issue outside your list, the refusal gets reported to your inbox.

Why nobody sets it

Two reasons, and both are fair.

First, a missing CAA record has no symptom. The website loads. Email arrives. Nothing in your week runs worse for not having it. It is the same psychology I wrote about with DNSSEC: invisible controls lose every prioritisation contest against visible problems.

Second - and this is the legitimate one - getting CAA wrong can hurt you. List the wrong authority and your own certificate renewal fails, usually at a moment chosen by Murphy. I have watched competent sysadmins lose an evening to exactly that. So the conventional wisdom became: unless you know precisely which authority issues your certificates, leave CAA alone. For a small business with no IT staff, that was sound advice.

The Cloudflare twist

Here is what changed, and why I am writing this now.

Cloudflare issues your site's certificate through its partner authorities - Let's Encrypt, Google Trust Services, SSL.com, Sectigo; the list is public. And Cloudflare's own documentation spells out the behaviour that matters: when your zone has Universal SSL and you add any CAA record, Cloudflare automatically publishes the CAA records its authorities need. You will not see those records in your dashboard. Query DNS directly:

dig yourdomain.com.au caa +short

There they are, maintained for you, updated when Cloudflare's authority list changes.

Which means the classic failure mode is gone. You cannot lock yourself out of your own certificate renewal, because Cloudflare manages the allow-list dynamically. The only thing left for you to do is switch the mechanism on - and the cleanest switch is the reporting record.

In the Cloudflare dashboard, open DNS, then Records, and add a record of type CAA. Name: your domain. Tag: send violation reports to URL - that is the iodef option. Value: mailto: and an email address you actually read. Save.

That single record does two jobs at once. Its presence triggers Cloudflare's automatic allow-list, so certificate issuance for your domain is now restricted to the authorities genuinely serving your site. And the record itself tells every authority on earth where to report an attempt that falls outside the list. Control on one side, visibility on the other. The loop is closed.

I timed it on one of my own zones this week. Including logging in: under 2 minutes. While you are in there, Cloudflare's Certificate Transparency Monitoring toggle is worth flipping as well - it emails you whenever any certificate is issued for your domain, which is the other half of the visibility story.

The honest caveats

If you bought a certificate from another provider for your origin server, add a CAA record allowing that authority too, before you rely on the automatic ones. If only a subdomain of your business sits on Cloudflare, the rules change - CAA is inherited from the parent domain, so check where the parent's DNS actually lives. The same applies if your hostname points at someone else's domain through a CNAME: their CAA records can take precedence over yours.

And be clear-eyed about what CAA is. It binds authorities that follow the rules, which the publicly trusted ones overwhelmingly do. It is a guard rail, not a forcefield. Layers, not magic.

The bit I keep coming back to

It is the multinational number. Three in four of the largest organisations we scanned - entities with dedicated security functions and standing audit relationships - have not published a record that a sole trader can set before their coffee goes cold. I do not think that is laziness. I think nobody in those organisations has looked at what their DNS actually says recently, because DNS is always somebody else's problem until it very suddenly is not.

Your zone takes one look. Run:

dig yourdomain.com.au caa +short

Or just open the DNS tab and see for yourself. If it comes back empty, you now know a 2-minute fix that puts you ahead of most of the ASX.

What else in your DNS would surprise you, if you looked?