Guides

How to set up a CAA record

A CAA record (Certification Authority Authorization) states which certificate authorities are allowed to issue SSL for your domain. It closes the case where someone tries to get a certificate for your domain through a different authority. You set it once in the DNS zone and it takes a few minutes.

1. Find out who issues your certificates

   Check which authority issued your current certificate: on cPanel hosting with AutoSSL it is usually Let's Encrypt (the letsencrypt.org tag). That is the one you must allow, otherwise auto-renewal breaks.

2. Open the DNS zone editor

   In cPanel open Zone Editor and pick your domain. If DNS is managed at your registrar or Cloudflare, work in their panel instead, the idea is the same.

3. Add a base CAA for your main authority

   Create a CAA record: Name is your domain, Flags 0, Tag issue, Value letsencrypt.org. This lets Let's Encrypt issue standard certificates.

4. Allow wildcards separately if needed

   If you use a wildcard certificate (for example *.techguard.space), add a second record with the issuewild tag and the same letsencrypt.org value. Without it wildcard issuance can be blocked.

5. Add a contact for violation reports

   A record with the iodef tag and a mailto:admin@yourdomain value gives the authority a channel to report an attempted unauthorized issuance. This step is optional but useful.

6. Do not lock out your own authority by accident

   Adding issue for a single authority automatically forbids all others. List every authority you actually use, including any that issue certificates for mail or subdomains.

7. Let DNS propagate

   Save the zone and wait out the record TTL (usually minutes to hours). An authority checks CAA at the moment of issuance, so the change takes effect from the next renewal.

How to verify the result

Check the domain with the TechGuard DNS tool, which lists the CAA records in the zone. Make sure the authority that renews your certificate is among the allowed ones.

Tip: A wrong CAA value is the most common reason AutoSSL suddenly stops renewing a certificate, so match the issue tag to the real authority.

Related guides

• How to migrate a domain to new hosting without downtime