Docs

Add a CAA record

Add a CAA record

There are dozens of certificate authorities, and by default every one of them may issue a certificate for your domain. CAA is a DNS record that names the ones you actually use. Every public CA must check it before issuing, so a mistake or a trick at an authority you never deal with no longer ends with a valid certificate for example.com in someone else's hands.

It is a small, optional hardening step, so the site checklist shows a missing CAA record as information, not as a problem. It is worth doing once the domain matters to you, as long as you do it carefully: a CAA record that leaves out your real CA stops your certificate from renewing.

What a record looks like

Type Name Value TTL
CAA @ 0 issue "letsencrypt.org" 3600
CAA @ 0 issue "sectigo.com" 3600
CAA @ 0 iodef "mailto:security@example.com" 3600
Part Meaning
0 flags; always 0
issue this CA may issue normal certificates
issuewild this CA may issue wildcard certificates (*.example.com); without it, issue covers wildcards too
iodef optional: where a CA may report a refused request; not every CA sends reports

The value is the CA's own domain:

Certificate authority Value
Let's Encrypt letsencrypt.org
Sectigo (formerly Comodo) sectigo.com
DigiCert (also GeoTrust, RapidSSL, Thawte) digicert.com
Google Trust Services pki.goog
GlobalSign globalsign.com
ZeroSSL sectigo.com
Amazon (AWS Certificate Manager) amazon.com

A record on example.com also covers every subdomain (www, shop, mail) unless that subdomain has CAA records of its own.

Find out which CAs you use

This is the step that matters. List everything that holds a certificate for the domain or any subdomain: the web host, the CDN, the shop or landing-page platform on shop.example.com, the mail server, a status page on your own domain. Then see who issued each certificate:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer
echo | openssl s_client -connect shop.example.com:443 -servername shop.example.com 2>/dev/null | openssl x509 -noout -issuer

An issuer with O = Let's Encrypt means letsencrypt.org, O = Sectigo Limited means sectigo.com, O = Google Trust Services means pki.goog.

Warning: the CA in use today is not always the one used at the next renewal. cPanel AutoSSL can use either Sectigo or Let's Encrypt depending on the host's choice, and hosts sometimes switch. Cloudflare uses several CAs. When in doubt, allow both or ask the host.

Check it yourself

dig +short CAA example.com

No output means no CAA record (every CA may issue). Fixed means one line per allowed CA, like 0 issue "letsencrypt.org".

How to fix

Add one CAA record per CA at the place where the domain's DNS is hosted (dig +short NS example.com tells you where).

cPanel

  1. Find out which CA AutoSSL uses on your host: check the issuer with the openssl command above, and if unsure ask support. Most hosts use Sectigo or Let's Encrypt.
  2. Open Domains → Zone Editor and click Manage next to the domain.
  3. Add Record, choose type CAA, name example.com., flag 0, tag issue, value letsencrypt.org (or sectigo.com), and Save Record.
  4. Repeat for each CA you need.

After adding the records, run SSL/TLS Status → Run AutoSSL and make sure it still succeeds.

If the domain's DNS is hosted elsewhere, add the records there instead.

Plesk

Plesk issues certificates with Let's Encrypt through its SSL It! extension, unless you installed another certificate yourself.

  1. Websites & Domains → example.com → Hosting & DNS → DNS (older versions: DNS Settings).
  2. Add Record, type CAA, flag 0, tag issue, value letsencrypt.org.
  3. Click OK and apply the changes with Update if Plesk asks.

If you also use a purchased certificate (DigiCert, Sectigo), add a record for that CA too.

DirectAdmin

DirectAdmin's built-in certificates come from Let's Encrypt (or ZeroSSL, if the host changed it). In Account Manager → DNS Management, add a record of type CAA with the value 0 issue "letsencrypt.org" (and 0 issue "sectigo.com" for ZeroSSL).

If CAA is not offered in the type list, your DirectAdmin version or host does not support it: ask the host to add the record.

Cloudflare

When Cloudflare's Universal SSL or Advanced Certificate Manager is active, Cloudflare uses several CAs and adds the CAA records it needs automatically as soon as you add any CAA record yourself. You do not see them in the dashboard, but dig shows them. So you only add records for certificates that do not come from Cloudflare, for example the certificate on your origin server or on a subdomain that is not proxied.

  1. Open the domain and go to DNS → Records → Add record.
  2. Type CAA, name @, flags 0, tag Only allow specific hostnames, CA domain name letsencrypt.org.
  3. Save, and repeat for other CAs you use.

Afterwards run dig +short CAA example.com: Cloudflare's own entries should appear next to yours.

DNS provider

In your DNS zone, add one CAA record per CA:

Type Name / Host Flags Tag Value TTL
CAA @ 0 issue letsencrypt.org 3600
CAA @ 0 issue sectigo.com 3600

Some providers have separate fields for flags, tag and value; others take one line like 0 issue "letsencrypt.org". If the provider does not offer the CAA type at all, you cannot add one there, and the checklist item stays informational.

Pitfalls

  • Subdomains on other platforms. If shop.example.com points with a CNAME to a shop or site builder, that platform issues its certificate, and your apex CAA records apply to it. Leave its CA out and the shop's certificate fails at the next renewal, often 60 to 90 days later, when nobody remembers the change.
  • Renewal is when it breaks. CAA does not affect existing certificates. The first sign of a mistake is a renewal error weeks later. PulseKeeper's SSL check warns before the certificate expires, which gives you time to fix the record.
  • Remove CAs you stop using, but only after the last certificate from them has been replaced.

Confirm the fix

Run the dig command from Check it yourself again, then open the target in PulseKeeper and click Check now on the Checklist tab. The item shows the allowed CAs within a few minutes.