# What does a CAA DNS record control?

Canonical URL: https://help.iagenify.com/faqs/domains/what-does-a-caa-dns-record-control

[← Back to Domains FAQs](https://help.iagenify.com/faqs/domains)

HELP CENTER · FAQ Domains 1 min read
# What does a CAA DNS record control?
A CAA record tells certificate authorities which issuers are authorized to issue certificates for a domain, subject to each authority's support and validation rules. It does not create or guarantee a certificate; an overly restrictive or misplaced record can block a legitimate renewal.
IaGenify
Domains

## Place policy at the right DNS name
CAA policy can be evaluated for a requested hostname and inherited from a parent name when no closer policy exists. Check the exact hostname and relevant records before assuming a root-domain change covers every subdomain.
Use issuer identifiers and issuewild or reporting tags according to the certificate authority's documentation. A spelling error, unsupported value, or omitted automated-renewal provider can prevent issuance.
## Validate changes before certificate renewal
Inventory certificate providers for the apex and subdomains, including alternate recovery paths, then authorize only the intended issuers. Identifiers are provider-specific, so do not copy sample values blindly.
After changing CAA, query authoritative DNS and confirm resolver-visible records. Test issuance or renewal through the provider's supported process and retain a way to correct policy before certificates near expiration. [← Back to Domains FAQs](https://help.iagenify.com/faqs/domains)