CAA Records: Controlling Which Authorities Can Issue Your SSL

A CAA record is a small DNS entry that tells the world exactly which certificate authorities are allowed to issue SSL certificates for your domain. It is one of the quieter corners of DNS, but on Ultra Web Hosting it has an outsized effect: a CAA record set too tightly is one of the most common reasons AutoSSL silently refuses to issue a certificate. This guide explains what CAA records do, how to write one that protects your domain without breaking our automatic SSL, and how to add one in cPanel.

01. What a CAA Record Is

CAA stands for Certification Authority Authorization. It is a DNS record type, sitting in your zone alongside your A, MX, and TXT records, whose only job is to list which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for your domain. A certificate authority is the organization that signs and vouches for your certificate: Let's Encrypt, Sectigo, DigiCert, GoDaddy, and so on.

The key thing that makes CAA useful is that it is not just advisory. Under the rules every public CA agrees to, a CA is required to look up your domain's CAA record before it issues a certificate. If your CAA record exists and does not list that CA, the CA must refuse to issue. If there is no CAA record at all, any CA may issue. That single rule is the whole point of CAA.

02. Why CAA Records Exist

Before CAA, any trusted certificate authority in the world could issue a certificate for any domain. That is a lot of trust spread across a lot of organizations. If a single CA was tricked or compromised into issuing a certificate for your domain to someone else, that someone could impersonate your site over HTTPS and most browsers would accept it.

CAA narrows that exposure. By publishing a CAA record, you are effectively saying "only these specific authorities may issue for me, and every other CA on earth is instructed to say no." It does not make mis-issuance impossible, but it removes the ability of the hundreds of CAs you do not use from being a weak link. For a security-conscious organization, that is a meaningful reduction in attack surface.

03. The Anatomy of a CAA Record

A CAA record has three parts: a flags byte, a tag, and a value. In most DNS editors you enter them as three fields; in raw zone-file form they sit on one line after the record type.

• Flags - a number, almost always 0. The only defined flag is 128 (the "issuer critical" bit), which tells a CA to refuse issuance if it does not understand the record. Use 0 unless you have a specific reason not to.
• Tag - one of three keywords that says what the value means:
  • issue - names a CA allowed to issue regular (single-name and multi-name) certificates.
  • issuewild - names a CA allowed to issue wildcard certificates (like *.yourdomain.com). If absent, the issue rules apply to wildcards too.
  • iodef - a contact URL (usually a mailto:) where a CA reports an attempted policy violation.
• Value - for issue and issuewild, the CA's identifying domain (for example letsencrypt.org). For iodef, a reporting address.

Here is a set of CAA records that allows the common authorities most people encounter, written in zone-file form:

yourdomain.com.  IN  CAA  0 issue "letsencrypt.org"
yourdomain.com.  IN  CAA  0 issue "sectigo.com"
yourdomain.com.  IN  CAA  0 issue "comodoca.com"
yourdomain.com.  IN  CAA  0 issue "digicert.com"
yourdomain.com.  IN  CAA  0 issuewild "letsencrypt.org"
yourdomain.com.  IN  CAA  0 iodef "mailto:[email protected]"

You can have as many issue lines as you have CAs to authorize. Every CA you leave off the list is, by definition, told to refuse.

04. How a CAA Record Can Break AutoSSL

This is the part that brings most people to this page. Every Ultra Web Hosting cPanel account gets free SSL through AutoSSL, which requests and renews certificates for you automatically. AutoSSL uses a specific certificate authority behind the scenes (cPanel's own CA, backed by Sectigo, with Let's Encrypt available as well). Those CAs have to be allowed by your CAA record, or they cannot issue.

Here is the failure mode. Suppose you bought a certificate from another provider a year ago and, as part of that, added a CAA record like this:

yourdomain.com.  IN  CAA  0 issue "digicert.com"

That record says "only DigiCert may issue for this domain." It works fine for the DigiCert certificate. But the moment AutoSSL tries to issue or renew, cPanel's CA checks your CAA record, sees it is not on the list, and is required to refuse. AutoSSL does not get a certificate. There is no error in your DNS, no warning email from the CAA record itself, and the site quietly heads toward an expired certificate. This is a leading cause of the exact problem covered in our "AutoSSL Not Issuing: How to Fix SSL Certificate Errors" guide.

05. Check Whether Your Domain Has a CAA Record

Before you add or blame a CAA record, find out whether one already exists. Plenty of domains carry a CAA record left over from an old certificate purchase that nobody remembers.

1. Open our DNS Lookup tool.
2. Enter your domain and select the CAA record type (or run an "any" lookup and read the CAA lines).
3. Read the result. If it comes back empty, you have no CAA record and any CA may issue. If it lists issue values, note every CA named, because those are the only authorities currently allowed.
4. Compare that list against the CAs our AutoSSL uses (Section 06). If cPanel's CA and Let's Encrypt are missing, that is very likely why AutoSSL is failing.

06. Write a CAA Record That Allows Our AutoSSL

If you want CAA protection but still want our free AutoSSL to keep working, the answer is simple: keep your restrictive CAA record, but make sure it also authorizes the CAs cPanel uses. Our AutoSSL issues through cPanel's certificate authority, which is backed by Sectigo, and Let's Encrypt is also available. A safe record set that permits AutoSSL looks like this:

yourdomain.com.  IN  CAA  0 issue "sectigo.com"
yourdomain.com.  IN  CAA  0 issue "comodoca.com"
yourdomain.com.  IN  CAA  0 issue "letsencrypt.org"
yourdomain.com.  IN  CAA  0 issuewild "sectigo.com"
yourdomain.com.  IN  CAA  0 issuewild "letsencrypt.org"
yourdomain.com.  IN  CAA  0 iodef "mailto:[email protected]"

If you also buy certificates from a third party (say DigiCert or GoDaddy for a specific hostname), add their issue line too. The rule is straightforward: every CA that will ever issue for your domain must appear in the record, and any CA not listed is refused.

07. Add or Edit a CAA Record in cPanel Zone Editor

If your domain uses our nameservers (ns1.ultranameservers.com, ns2.ultranameservers.com, ns3.ultranameservers.com), you manage CAA records in cPanel Zone Editor. If your DNS lives at Cloudflare or another provider, add the same record there instead.

1. Log in to cPanel and open Zone Editor (under the Domains section).
2. Find your domain and click Manage.
3. Click + Add Record and choose type CAA from the dropdown.
4. Set Name to your domain at the zone root, for example yourdomain.com. with the trailing dot.
5. Set Flag to 0.
6. Set Tag to issue (or issuewild / iodef).
7. Set Value to the CA domain, for example letsencrypt.org (no quotes needed in the cPanel field).
8. Set TTL to 3600 and click Save Record.
9. Repeat for each CA you want to authorize. To edit an existing CAA record, click Edit beside it instead of adding a new one.

For a fuller walkthrough of the Zone Editor interface, including how to find and edit existing records, see our "How to Manage DNS Records in cPanel Zone Editor" guide.

08. Should You Bother With CAA at All?

Honest answer: most small websites do not need a CAA record, and adding one carelessly does more harm than good. If you run a personal blog, a small business brochure site, or a typical WordPress install on our AutoSSL, the default of "no CAA record" is perfectly safe and means one less thing that can break your SSL.

CAA earns its keep when the stakes are higher:

• Security-conscious organizations - banks, healthcare, government, and anyone under a compliance regime that asks for CA pinning.
• High-value brands - domains where a fraudulently issued certificate would be a serious impersonation or phishing risk.
• Organizations that standardize on one CA - enterprises that buy all certificates through a single provider and want to enforce that policy technically.

Two optional pieces worth knowing when you do use CAA. Use issuewild to control wildcard certificates separately: for example, you can allow a CA to issue normal certificates but forbid wildcards, which limits blast radius if a wildcard is ever mis-issued. And use iodef to give CAs a reporting address, so if someone tries to obtain a certificate they are not allowed to, the CA can email you about the attempt.

09. Troubleshooting CAA and SSL Issues

SSL stopped issuing right after I added a CAA record. Your CAA record is too restrictive. It does not include the CAs our AutoSSL uses. Either remove the CAA record entirely (safe for most sites) or add the correct issue values from Section 06 so cPanel's CA and Let's Encrypt are allowed.

I have a CAA record but I do not know why. It was likely added when a previous certificate was purchased. Look it up with our DNS Lookup tool, list the CAs it names, and decide whether you still need those restrictions. If in doubt for a small site, removing it is the low-risk choice.

AutoSSL still fails and my CAA looks correct. Then the CAA record probably is not the culprit. Check the domain control validation path next, since a bad htaccess rewrite can block the HTTP check. See Let's Encrypt htaccess Validation and our "AutoSSL Not Issuing: How to Fix SSL Certificate Errors" guide.

I edited the CAA record but the CA still refuses. DNS changes are not instant. The CA may still be seeing the old record from cache. Confirm the new value is live with our DNS Lookup tool, then wait for the old TTL to expire before retrying. For why changes take time to spread, see DNS Propagation.

Wildcard certificate will not issue but the normal one does. You have an issue record that allows the CA but an issuewild record that does not, or an issuewild for a different CA. Make sure the CA issuing your wildcard appears in an issuewild line (or remove the issuewild lines so the issue rules apply to wildcards too).

Quick Recap: CAA in Six Points

If you only take six things from this guide, take these:

1. A CAA record lists which CAs may issue certificates for your domain, and CAs are required to check it before issuing.
2. No CAA record means any CA can issue, which is a safe default for most small sites.
3. A restrictive CAA that omits our CAs breaks AutoSSL silently, and this is a common cause of "AutoSSL not issuing."
4. If you keep a CAA record, include cPanel's CA (Sectigo) and Let's Encrypt so AutoSSL keeps working.
5. Check your existing record with our DNS Lookup tool before adding or blaming one.
6. Use issuewild for wildcard control and iodef for violation reports when you do decide to run CAA.

Last updated July 2026 · Browse all DNS articles