How do I completely block wildcard certificates?

Publish a CAA record with the tag `issuewild` and value `";"` (e.g. `example.com. IN CAA 0 issuewild ";"`). This forbids all CAs from issuing wildcard certificates.

Updated: August 2026 • Verified v1.2

DNS CAA Record Generator (SSL/TLS Security Hardening)

Internet & NetworkNetwork

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

[domain]. 3600 IN CAA [flag] [tag] "[value]"

Was this calculation helpful?

Understanding Your Results

Generates RFC 6844/8659 compliant BIND zone entries and single-line DNS records specifying authorized CAs (`issue`), wildcard issuance rules (`issuewild`), and incident email alerts (`iodef`), complete with `dig` verification commands.

Practical Guidance & Next Steps

All public Certificate Authorities are legally mandated to check DNS CAA records before issuing certificates. Publishing a CAA record prevents unauthorized third-party certificate issuance.

What is this?

A domain security utility that builds DNS CAA records to restrict which Certificate Authorities can issue SSL certificates for your domain.

How does it work?

1. Enter your domain name. 2. Select authorized CAs (Let's Encrypt, DigiCert, Amazon ACM) and wildcard policy. 3. Copy the BIND zone records and test with the provided dig command.

Why use it?

Prevents unauthorized SSL certificate creation and hardens your domain against man-in-the-middle attacks.

Technical Scope & Calculation Limitations

Generates RFC 8659 standard CAA records.

Frequently Asked Questions

If no CAA records exist, ANY public Certificate Authority in the world is permitted to issue an SSL/TLS certificate for your domain. Adding a CAA record restricts issuance strictly to the CAs you specify.

Windows Desktop & Widget Options