CAA records
This guide explains what a CAA record does, when it helps, and how a wrong CAA record can block a certificate from being issued.
A CAA record names the certificate authorities (companies that issue SSL certificates) that are allowed to issue certificates for your domain. Before a certificate is issued, the issuing company may check for CAA records. If the record does not allow it, the certificate is refused.
Example, using a reserved documentation name for the authority:
text
example.com. CAA 0 issue "ca.example.net"Points to remember:
- CAA is optional. A domain with no CAA record allows any authority to issue.
- A CAA record that names the wrong authority can stop a certificate from being issued. If you change the authority that issues your certificates, update the CAA record first.
- For SSL certificate ordering and installation, read SSL certificates.
Related articles
Last reviewed
2026-10-27