--- title: "How can CAA records strengthen BIMI implementation | DuoCircle" description: "How can CAA records strengthen BIMI implementation." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/" --- Quick Answer Certification Authority Authorization (CAA) records are DNS records that specify which certificate authorities are allowed to issue SSL/TLS certificates for your domain. They strengthen BIMI by protecting the Verified Mark Certificate (VMC) that lets your logo render in inboxes. Three benefits: control over which CAs can issue your certificates, so attackers cannot obtain a fraudulent certificate from an unauthorized CA; automatic denial of certificate requests from any CA not listed in your CAA record, blocking unauthorized issuance; and protection of your VMC specifically, ensuring that the certificate enabling your BIMI logo is issued only by trusted authorities. SPF, DKIM, and DMARC alone do not stop attackers from obtaining unauthorized SSL/TLS certificates in your domain's name. Without CAA, any CA could technically issue a certificate for your domain. Configure CAA records to lock down certificate issuance and keep your BIMI implementation trustworthy end-to-end. How can CAA records strengthen BIMI implementation Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2025/10/How-can-CAA-records-strengthen-BIMI-implementation.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fhow-can-caa-records-strengthen-bimi-implementation%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20can%20CAA%20records%20strengthen%20BIMI%20implementation&url=undefined%2Fblog%2Fdmarc%2Fhow-can-caa-records-strengthen-bimi-implementation%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fhow-can-caa-records-strengthen-bimi-implementation%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fhow-can-caa-records-strengthen-bimi-implementation%2F&title=How%20can%20CAA%20records%20strengthen%20BIMI%20implementation "Share on Reddit") [ ](mailto:?subject=How%20can%20CAA%20records%20strengthen%20BIMI%20implementation&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fhow-can-caa-records-strengthen-bimi-implementation%2F "Share via Email") ![CAA record](https://media.mailhop.org/duocircle/images/2025/10/dmarc-report-4562.jpg) When the **digital landscape** is already flooded with fake and [fraudulent emails](https://www.newsweek.com/scam-emails-people-most-likely-fall-for-revealed-experts-10956452), proving your legitimacy is essential but also very challenging. While you might be creating an email to send out to your clients, a group of cyberattackers might have already crafted and launched a [phishing campaign](https://www.infosecurity-magazine.com/news/ai-generated-code-phishing/) that looks like it came from your brand. _So, to prevent your clients from falling prey to these tactics, they should be instantly able to recognize that the email is genuinely from you_. And that’s precisely what BIMI does: it **adds a layer of visual trust** to your emails by displaying your verified brand logo right next to your message in the recipient’s inbox. While BIMI tells your recipients who you are, you need to tell BIMI that it can trust you. That’s where CAA (Certification Authority Authorization) records come in. [CAA records](https://support.dnsimple.com/articles/caa-record/) define which **certificate authorities** are allowed to issue digital certificates for your domain. So, basically, they ensure that only the certificate authorities you approve can issue digital certificates for it. In this article, we will understand how these records can support a more secure and trustworthy [BIMI](/email-security/understanding-bimi-and-its-relevance-in-email-authentication/) implementation. [![certificate](https://media.mailhop.org/duocircle/images/2025/10/spf-record-9907.jpg)](https://media.mailhop.org/duocircle/images/2025/10/spf-record-9907.jpg) ## How can you build trust through visibility with BIMI? _When you implement BIMI, you are giving your emails a visual identity with your verified logo_. This gives your recipients a sense of trust that the email is indeed coming from you and not someone pretending to be you. When your users see the logo next to your email, they instantly identify it as genuine without having to **second-guess its source**. For BIMI to work, you can’t just upload your logo and expect it to show up next to your emails. Your domain needs to be authenticated with [SPF](https://autospf.com/blog/spf-guide-understanding-sender-policy-framework/), DKIM, and [DMARC](/resources/what-is-dmarc). These authentication protocols tell email providers that your messages are real, **come from your domain**, and haven’t been changed on the way. To make this setup even stronger, you can add CAA records to your domain. These records ensure that only trusted authorities can issue the certificates needed for BIMI, **keeping your brand logo** and identity safe from misuse. ## What are CAA records, and what do they do? A Certification Authority Authorization (CAA) record is a type of [DNS record](https://www.cloudflare.com/learning/dns/dns-records/) that lets you control which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. Once you have listed the approved CAs in the CAA record, no one else can issue a certificate for your domain without your knowledge. [![cybercriminals](https://media.mailhop.org/duocircle/images/2025/10/dkim-validation-4564.jpg)](https://media.mailhop.org/duocircle/images/2025/10/dkim-validation-4564.jpg) You need this kind of control because digital certificates are what **verify your domain’s identity** on the internet. And as [cybercriminals](https://incyber.org/en/article/united-states-amounts-stolen-by-cybercriminals-up-33/) are becoming smarter by the day, they can easily trick the certificate authorities by issuing fake certificates. With CAA records, you can stop that from happening. They make sure that only the **certificate authorities** you’ve approved can issue certificates for your domain, blocking all unauthorized requests. This helps keep your domain safe and stops anyone from creating fake certificates in your name. It also protects your [brand reputation](https://influencity.com/blog/en/brand-reputation-definition) and ensures that protocols like BIMI can fully trust your domain. ## How do CAA records strengthen BIMI implementation? As we discussed earlier, for BIMI to work, you just can’t upload your logo and expect it to appear in your recipients’ inboxes. You need to meet certain requirements, like authenticating your domain with SPF, DKIM, and DMARC, and obtaining a [Verified Mark Certificate (VMC)](https://www.digicert.com/faq/email-trust/what-is-a-verified-mark-certificate) to verify your brand logo. Speaking of VMC, you only get this certificate from trusted and approved Certificate Authorities (CAs). _To make sure these certificates are issued safely and only by trusted sources, CAA (Certification Authority Authorization) records help you control which certificate authorities can issue them for your domain_. They work like a safety check, allowing only the ones you approve and blocking all others. Let’s dig deeper to understand how exactly CAA records can **strengthen your BIMI setup**. ### Controls which authorities can issue your certificates This is the most **important aspect of CAA records**. They let you specify which authorities are allowed to issue certificates on your behalf. By doing this, you get full control over your domain’s certificate issuing process and ensure that a cyber attacker does not obtain a [fake or unauthorized certificate](https://cybersecuritynews.com/hackers-using-fake-certificates/) in your name. This control helps prevent misuse of your domain and keeps your BIMI implementation secure and trustworthy. [![Fake or Unauthorized Certificates](https://media.mailhop.org/duocircle/images/2025/10/dmarc-generator-0034.jpg)](https://media.mailhop.org/duocircle/images/2025/10/dmarc-generator-0034.jpg) ### Prevents misuse and unauthorized access With CAA records in place, only approved authorities can issue certificates. _This means that any request from an authority other than those you’ve listed in your CAA record will be automatically denied_. This helps stop anyone from getting fake certificates and keeps attackers from pretending to be your **brand or using your domain** without permission. So, when you implement BIMI, it ensures that your Verified Mark Certificate (VMC) is issued only by trusted authorities, keeping your brand logo genuine and your BIMI setup secure. ### Protects your Verified Mark Certificate (VMC) The VMC certificate is what makes it possible for your **logo to appear next to your emails**. It verifies that the logo truly belongs to your domain. So if someone tries to forge or obtain a fake VMC, they can easily trick users into thinking a [phishing email](/content/phishing-prevention/phishing-email) is from your brand. _But you can prevent this with CAA records, as they block any unauthorized certificate requests_. So, they make sure your VMC is issued only by trusted authorities, keeping your logo, emails, and brand identity secure. ## Securing your domain with CAA records _It would be naive to think that your domain is already secure enough if you’ve only set up SPF, DKIM, and DMARC_. While these protocols offer strong protection against [spoofing or phishing](https://www.scworld.com/brief/fbi-us-officials-spoofed-in-ongoing-voice-sms-phishing-campaign), they don’t stop attackers from getting unauthorized [SSL/TLS certificates](https://www.digicert.com/tls-ssl/tls-ssl-certificates) in your **domain’s name**. For that, it is important that you configure CAA records, or else any certificate authority could technically issue a certificate for your domain, even without your approval. To know more about these records or **how to configure CAA records** for efficient BIMI implementation, [get in touch](/contact) with [DuoCircle](/) today! ## Topics DKIMDMARCspf ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ DMARC 6m How to become a DMARC expert: a 6-step learning path Sep 24, 2024 ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/)[ DMARC 6m A guide to detecting DMARC problems using the pentesting techniques Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[ DMARC 6m Avoiding common BIMI pitfalls: What goes wrong and how to fix it Jun 24, 2025 ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/)[ DMARC 3m Can threat actors bypass DMARC? Feb 21, 2025 ](/blog/dmarc/can-threat-actors-bypass-dmarc/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How can CAA records strengthen BIMI implementation","description":"How can CAA records strengthen BIMI implementation.","url":"https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/","datePublished":"2025-10-30T17:24:29.000Z","dateModified":"2025-10-30T18:28:25.000Z","dateCreated":"2025-10-30T17:24:29.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf","wordCount":1010,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/10/dmarc-report-4562.jpg","caption":"CAA record","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"How can CAA records strengthen BIMI implementation","item":"https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"How can CAA records strengthen BIMI implementation","item":"https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How can CAA records strengthen BIMI implementation","description":"How can CAA records strengthen BIMI implementation.","url":"https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/","datePublished":"2025-10-30T17:24:29.000Z","dateModified":"2025-10-30T18:28:25.000Z","dateCreated":"2025-10-30T17:24:29.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/how-can-caa-records-strengthen-bimi-implementation/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf","wordCount":1010,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/10/dmarc-report-4562.jpg","caption":"CAA record","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```