Defaults.Exposed › Setup walkthroughs › CAA

CAA setup walkthroughs by provider

Pick the provider that hosts your DNS (Domain Name System) or sends your mail. Each page shows where the CAA (Certification Authority Authorization) record goes in that provider's console and what to type in each box.

What the CAA record does

A CAA record names the certificate authorities allowed to issue certificates for your domain. An authority has to check it before it issues, and one the record does not list must refuse to issue.

List every authority you use before you publish it, including the one behind your CDN (Content Delivery Network) or hosting platform. A renewal from an authority that is not listed will fail. The record can also carry an iodef address, where an authority may report a request it turned down.

CAA providers

• Route 53 CAA record, step by step
• Add a CAA record in Cloudflare

Before and after you add CAA

• How to fix CAA records: what the record does and how a failing one is fixed.
• DNS and DNSSEC: what signing changes and what it breaks
• The CAA records check: pass and fail rules
• Walkthroughs for the other records