CAA (Certification Authority Authorisation) is a type of DNS record that allows you to specify which certification authorities (CAs) are authorised to issue SSL certificates for your domain. Certification authorities are required to check the CAA record before issuing a certificate, and if they are not listed in it, they must reject the request.

The CAA record is not mandatory. If the domain does not have a CAA record, any certificate authority can issue a certificate for it (provided, of course, that domain validation has been successfully completed).

What is it for?

The CAA record provides an extra layer of security: even if an attacker were somehow to bypass the checks of a less stringent certificate authority, that authority would be unable to issue a certificate for the domain because it is not listed in the CAA record. For larger organisations, it also helps to ensure that staff cannot request a certificate from another certificate authority without authorisation.

What does it look like?

pelda.hu.  CAA  0 issue "letsencrypt.org"
pelda.hu.  CAA  0 issue "sectigo.com"
pelda.hu.  CAA  0 issuewild "sectigo.com"
pelda.hu.  CAA  0 iodef "mailto:it@pelda.hu"

Tag	Meaning
issue	This registrar can issue certificates for the domain (including wildcard certificates, if there is no separate issuewild record).
issuewild	This certificate authority can issue wildcard certificates (*.pelda.hu). If such a record exists, wildcard certificates may only be issued by the certificate authorities listed here.
iodef	Publishers can report to this address if they have rejected an irregular request.

The ‘0’ at the start is the flag; leave this as 0. The record also applies to subdomains, unless the subdomain has its own CAA record.

What value should I enter?

The CAA record must include every certificate authority from which the domain receives a certificate:

Certificate	Value
Free certificates for hosting (AutoSSL, Let’s Encrypt)	letsencrypt.org
Paid certificate via the client portal (issued by Sectigo)	sectigo.com
Domain behind a Cloudflare proxy	The nameservers used by Cloudflare (Cloudflare automatically adds CAA records when the proxy is enabled)

If you use another certificate authority (such as Google Trust Services or DigiCert), please include its name as well. You can find the exact value in the certificate authority’s documentation.

Important: if you set up a CAA record and omit a certificate authority from it, you will not receive a certificate from that authority at the next renewal. This is one of the common causes of AutoSSL errors: if letsencrypt.org is missing from the CAA record, the renewal of the free certificate will fail.

How do I set this up?

If your domain uses our name servers:

1. Log in to cPanel and, in the Domains section, click on the Zone Editor icon.
2. Next to the domain, click the ‘Manage’ button.
3. Click on the arrow next to the ‘Add Record’ button and select ‘Add CAA record’.
4. Enter the name (the domain), the label (issue, issuewild or iodef) and the value (for example, letsencrypt.org), then save.

If you manage your DNS elsewhere (for example, with Cloudflare or your domain registrar), you will need to add the record there.

How can I check this?

You can query a domain’s CAA records using the dig command:

dig CAA pelda.hu +short

If the command returns nothing, the domain has no CAA record, meaning that any certificate authority can issue a certificate for it. You can read about DNS record types in general in the article ‘Types of DNS records’.