CAA, AAAA and SOA DNS records
An AAAA record maps a hostname to an IPv6 address. A CAA record lists the certificate authorities allowed to issue SSL for the domain, which every public CA must check. The SOA record holds the zone’s primary nameserver, serial number and refresh timers. Edit AAAA and CAA deliberately; leave SOA to your DNS software.
For site owners and administrators editing a DNS zone who need to know what these three less common records control.
knowledge
- Read time
- 3 min
- Sections
- 4
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What do AAAA, CAA and SOA records do?
An AAAA record maps a hostname to an IPv6 address, a CAA record lists which certificate authorities may issue SSL certificates for the domain, and the SOA record holds the zone’s serial number and refresh timers. All three sit in the same DNS zone as your A, CNAME and MX records but do very different jobs.
| Record | Stores | Defined in | You edit it when |
|---|---|---|---|
| AAAA | An IPv6 address | RFC 3596 | Your server has a working IPv6 address |
| CAA | Allowed certificate authorities | RFC 8659 | You want to restrict who can issue certificates |
| SOA | Primary nameserver, admin mailbox, serial, timers | RFC 1035 | Rarely — only if you run the authoritative DNS server |
For the more common types, see DNS records explained and A record vs CNAME.
How does an AAAA record work for IPv6?
An AAAA record is the IPv6 equivalent of an A record: when a visitor’s device supports IPv6, its resolver asks for AAAA and connects to that address. IPv4-only visitors still use the A record, so a dual-stack site publishes both.
www.example.com. 3600 IN A 192.0.2.10
www.example.com. 3600 IN AAAA 2001:db8::10The addresses above are reserved documentation examples. Add an AAAA record only for an IPv6 address on which your web server actually listens, with a valid certificate. If the address is wrong, browsers usually fall back to IPv4 after a delay, but some apps, crawlers and mail servers simply fail. IPv4 vs IPv6 explains how the two address families coexist.
How does a CAA record restrict who can issue SSL certificates?
A CAA record names the certificate authorities allowed to issue for your domain; since September 2017 every public CA must check it and refuse to issue if it is not listed. With no CAA record at all, any CA may issue.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "sectigo.com"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"This set allows Let’s Encrypt and Sectigo to issue normal certificates, forbids wildcard certificates from anyone, and asks CAs to report refused requests to an email address.
| Tag | Controls | Common mistake |
|---|---|---|
issue | Who may issue non-wildcard certificates (and wildcards if no issuewild exists) | Using a brand name instead of the CA’s published identifier |
issuewild | Who may issue wildcard certificates | Adding it for one CA and forgetting it overrides issue for wildcards |
iodef | Where violation reports are sent | Treating it as permission to issue |
Each CA publishes its identifier: letsencrypt.org, sectigo.com, digicert.com, globalsign.com and pki.goog for Google Trust Services. CAs look up CAA on the exact name first, then walk up to the parent, so a record on example.com also covers www.example.com unless www has its own. Before ordering a wildcard SSL certificate, check that issuewild allows that CA.
What do the serial and timers in an SOA record mean?
Every zone has exactly one SOA (start of authority) record naming the primary nameserver and admin mailbox, followed by a serial and four timers that secondary nameservers and resolvers obey. The admin mailbox is written with a dot in place of the @.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. (
2026111401 ; serial (often YYYYMMDDnn)
7200 ; refresh (seconds)
1800 ; retry
1209600 ; expire
300 ) ; minimum (negative-cache TTL)| Field | Meaning |
|---|---|
| Primary nameserver | The source copy of the zone |
| Responsible mailbox | hostmaster.example.com. means hostmaster@example.com |
| Serial | Version number; must increase after each change or secondaries keep the old zone |
| Refresh | How often secondaries check the serial |
| Retry | Wait before retrying a failed refresh |
| Expire | How long secondaries keep answering if the primary is unreachable |
| Minimum | Since RFC 2308, how long resolvers cache “this name does not exist” |
The values shown illustrate field order, not a required setting. The minimum value matters in practice: if you query a new subdomain before creating it, resolvers may keep the “does not exist” answer for that long, which is often mistaken for slow DNS propagation.
How do you check AAAA, CAA and SOA records?
Query each type by name with dig on macOS or Linux, or use an online DNS lookup and choose the record type; a default lookup returns only A records.
dig AAAA www.example.com +short
dig CAA example.com +short
dig SOA example.com +short
# Windows PowerShell
Resolve-DnsName www.example.com -Type AAAA
Resolve-DnsName example.com -Type SOAComparing the SOA serial from each authoritative nameserver (dig @ns1.example.com SOA example.com +short) shows whether they all hold the latest zone. The WebJi® DNS lookup tool runs the same queries in a browser, and how to check DNS records covers the other types.
When should you edit these records on a hosting account?
Add AAAA only when your host gives the site a working IPv6 address, add CAA when you want to lock certificate issuance to your chosen CA, and leave SOA to the DNS software. Hosting panels such as cPanel raise the serial automatically on every edit.
- Confirm you are editing the zone at the nameservers the domain actually uses.
- Before adding CAA, list every CA that issues for the domain, including the free one your panel uses for AutoSSL, so renewals do not fail.
- After editing, query the record type and wait for the old record’s TTL before judging the result.
- If a certificate request fails with a CAA error, read the identifier in the error and add it as an
issuevalue.
Installing the certificate itself is a separate step; see how to install SSL in cPanel or the WebJi® SSL certificate options.
Frequently asked questions
Is a CAA record required for SSL?
No. Without a CAA record any public certificate authority may issue for the domain. CAA is an optional safeguard that reduces the risk of a certificate being issued by a CA you never use, for example after a mistake or an account compromise elsewhere.
Does a CAA record affect certificates already installed?
No. CAs check CAA only at the moment of issuance. Existing certificates keep working until they expire, but the next renewal will fail if the issuing CA is no longer listed, which is why AutoSSL and Let’s Encrypt renewals are the usual casualties of a hasty CAA edit.
Can I have more than one SOA record?
No. A zone has exactly one SOA record at its apex. A subdomain gets its own SOA only when it is delegated as a separate zone to other nameservers, for example when a team runs dev.example.com on its own DNS.
Should I add an AAAA record if my host does not support IPv6?
No. Publishing an IPv6 address that does not answer makes the site slower or unreachable for some IPv6 users and tools. Add AAAA only after your host confirms the IPv6 address and you have tested the site loads over it.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.