DNS CAA Catalog

CAA (Certification Authority Authorization) records allow domain owners to specify which Certificate Authorities are permitted to issue certificates for their domain. By setting CAA records, organizations can prevent unauthorized certificate issuance and strengthen their security posture. This catalog surveys CAA deployment across the top 10,000 domains to provide insight into real-world adoption patterns.

CAA Statistics Summary

10000
Total Domains
1777
With CAA Records
17.8%
1649 ✅
With 'issue' Records
16.5%
667 ✳️
With 'issuewild' Record
6.7%
548 📬
With 'iodef' Records
5.5%
19 📧
With 'issuemail' Records
0.2%
160 📩
With 'contactemail' Records
1.6%
0 📞
With 'contactphone' Records
0.0%

Top Certificate Authorities

✅ issue

✳️ issuewild

Certificate Authority Count %
digicert.com 395 4.0
letsencrypt.org 383 3.8
pki.goog 266 2.7
comodoca.com 214 2.1
ssl.com 206 2.1
amazon.com 146 1.5
sectigo.com 121 1.2
globalsign.com 89 0.9
amazonaws.com 54 0.5
amazontrust.com 37 0.4
awstrust.com 33 0.3
godaddy.com 27 0.3
pki.apple.com 25 0.2
certainly.com 18 0.2
harica.gr 11 0.1
telesec.de 7 0.1
trustasia.com 6 0.1
geotrust.com 6 0.1
certum.pl 6 0.1
usertrust.com 4 0.0
www.digicert.com 4 0.0
entrust.net 4 0.0
trust-provider.com 4 0.0
identrust.com 4 0.0
microsoft.com 4 0.0
thawte.com 3 0.0
cloudflare.com 2 0.0
rapidssl.com 2 0.0
swisssign.com 2 0.0
d-trust.net 2 0.0
emsign.com 2 0.0
lencr.org 1 0.0
wordpress.com 1 0.0
51ssl.com 1 0.0
certificates.godaddy.com 1 0.0
quovadisglobal.com 1 0.0
gandi.net 1 0.0
certum.eu 1 0.0
amazonaws.cn 1 0.0
entrust.com 1 0.0
pixfuture.com 1 0.0
symantec.com 1 0.0
comodo.com 1 0.0
affirmtrust.com 1 0.0
Domain ranking data from Cloudflare Radar used under CC BY-NC 4.0.