A CAA (Certification Authority Authorization) record is a DNS record that tells certificate authorities which of them are allowed to issue an SSL certificate for your domain. If your domain has no CAA record, any certificate authority can issue one. If it has a CAA record that lists the wrong authority, or is formatted incorrectly, certificate issuance and renewal for your domain can fail, sometimes without an obvious error message pointing to the cause.
What a CAA Record Does
Every domain's DNS zone can optionally include one or more CAA records. Each record names a specific certificate authority (CA), such as Let's Encrypt, and permits only that CA (or CAs) to issue certificates for the domain. This is a security feature: it stops a compromised or misconfigured account elsewhere from getting a certificate issued for your domain by a CA you never intended to use.
Most domains never need a CAA record at all, since the default (no record) already allows any CA to issue a certificate. You typically only need to add one if you want to explicitly restrict issuance to a specific CA, or if you're troubleshooting a certificate that keeps failing to issue or renew.
Why It Matters for Your SSL Certificate
If a CAA record already exists on your domain (for example, added previously by you, a developer, or a past host) and it does not include the CA your hosting account uses for free or paid certificates, issuance will be refused. This shows up as a certificate that silently fails to install or renew, even though everything else in your hosting account looks correctly configured.
If your free SSL certificate keeps failing to renew and you've ruled out the usual causes, check for an existing CAA record on the domain before troubleshooting further. An outdated or overly restrictive CAA record is a common, easy-to-miss cause.
How to Add or Edit a CAA Record
In cPanel
- Log in to cPanel and open Zone Editor (sometimes shown as DNS Zone Editor) under the Domains section.
- Find the domain you want to manage and click Manage.
- Click Add Record and select CAA as the record type.
- Leave the Name field as your domain (or a subdomain, if the record should only apply there).
- Set the Tag field to issue (for standard certificates) or issuewild (for wildcard certificates).
- Enter the certificate authority's domain in the Value field, for example letsencrypt.org for AutoSSL certificates.
- Click Save Record.
In DirectAdmin
- Log in to DirectAdmin and open DNS Management under the Domain Setup section.
- Select the domain you want to manage.
- Choose CAA from the record type options and click Add (the exact layout varies slightly by DirectAdmin theme).
- Set the flag to 0, the tag to issue (or issuewild for wildcard certificates), and the value to the certificate authority's domain, such as letsencrypt.org.
- Click Save to add the record.
A Typical CAA Record
A basic CAA record that allows only Let's Encrypt to issue standard certificates for a domain looks like this:
- Name: yourdomain.com
- Tag: issue
- Value: letsencrypt.org
If you're not sure which certificate authority your hosting account uses for free certificates, it's usually simplest to leave the domain without any CAA record rather than guess. Only add one if you have a specific reason to restrict issuance.
Like other DNS changes, a new or edited CAA record can take a little time to propagate before certificate issuance reflects it. If a certificate still fails right after saving the record, wait a while before troubleshooting further.
For general guidance on adding other record types, see How to Add or Edit a DNS Record (A, CNAME, MX, TXT). If your free certificate specifically isn't renewing, see Why Your Free SSL Certificate Didn't Renew Automatically.