CAA Records and SSL Certificates

Last updated October 22, 2026

Table of Contents

• How CAA affects certificate orders
• Required CAA values for DNSimple certificates
• Common CAA issues that block certificates
• CAA and auto-renewal
• Managing CAA records in DNSimple
• Have more questions?

A CAA (Certification Authority Authorization) record is a DNS record that specifies which Certificate Authorities are allowed to issue SSL certificates for your domain. CAs are required to check CAA records before issuing a certificate. If your domain has CAA records and the CA is not listed, the certificate request will be denied, even if domain validation succeeds.

How CAA affects certificate orders

When you order an SSL certificate, the CA checks your domain’s DNS for CAA records as one of the final steps before issuance:

• No CAA records present: Any CA is allowed to issue a certificate for the domain. This is the default behavior. If you have not explicitly added CAA records, your certificate orders will not be affected.
• CAA records present: Only the CAs listed in the records are allowed to issue. If the CA processing your order is not listed, the order will fail.

CAA records are inherited by subdomains. A CAA record on example.com applies to www.example.com, api.example.com, and all other subdomains unless a more specific CAA record is set on the subdomain itself. For the full details of CAA record behavior, including inheritance and the issuewild tag, see What Is a CAA Record? and the CAA Record Format and Policy Tags reference.

Required CAA values for DNSimple certificates

If you use CAA records and purchase certificates through DNSimple, you need to authorize the correct CA for each certificate type.

Sectigo certificates

For Sectigo single-name and wildcard SSL certificates, authorize sectigo.com:

example.com.  CAA 0 issue "sectigo.com"

For wildcard SSL certificates, add both an issue and an issuewild record. Sectigo wildcard SSL certificates include both the wildcard name (*.example.com) and the bare domain (example.com). The issue record covers the bare domain, and the issuewild record covers the wildcard name:

example.com.  CAA 0 issue "sectigo.com"
example.com.  CAA 0 issuewild "sectigo.com"

Let’s Encrypt certificates

For Let’s Encrypt single-name and wildcard SSL certificates, authorize letsencrypt.org:

example.com.  CAA 0 issue "letsencrypt.org"

For Let’s Encrypt wildcard SSL certificates, add both:

example.com.  CAA 0 issue "letsencrypt.org"
example.com.  CAA 0 issuewild "letsencrypt.org"

Using both Sectigo and Let’s Encrypt

If you use both certificate types for different domains or subdomains within the same zone, authorize both CAs:

example.com.  CAA 0 issue "sectigo.com"
example.com.  CAA 0 issue "letsencrypt.org"
example.com.  CAA 0 issuewild "sectigo.com"
example.com.  CAA 0 issuewild "letsencrypt.org"

Common CAA issues that block certificates

If your certificate order fails and you have CAA records configured, check for these common problems:

• CA not listed. The most straightforward cause: the CA for your certificate type is not in your CAA records. Add the appropriate issue (and issuewild for wildcards) record.
• issuewild records that leave out your CA. The issuewild tag specifically controls wildcard issuance. When a domain has issuewild records, they replace the issue records for wildcard names, so the CA must be listed in issuewild too. When there are no issuewild records, the issue records also cover wildcard names.
• CAA records on a parent domain. If you are ordering a certificate for app.example.com and example.com has CAA records, those records apply unless app.example.com has its own CAA records that override them.
• Stale records after switching CAs. If you previously used a different CA and configured CAA records for it, those records may still be in place. Update them to include your current CA.
• DNS propagation delay. After adding or changing CAA records, allow time for DNS propagation before retrying the certificate order.

CAA and auto-renewal

For Let’s Encrypt certificates with auto-renewal enabled, CAA records are checked every time auto-renewal runs. If CAA records are present and Let’s Encrypt is not authorized, the auto-renewal fails and DNSimple emails you.

DNSimple does not retry a failed auto-renewal. After you fix the CAA records, renew the certificate manually. If it has already expired, order a new certificate.

Managing CAA records in DNSimple

To add or update CAA records, see Manage CAA Records. For a detailed explanation of the record format, tag types, and examples, see CAA Record Format and Policy Tags.

Have more questions?

If you have any questions about CAA records and how they affect your SSL certificates, just contact support, and we’ll be happy to help.