Defaults.Exposed

Add a CAA record in Cloudflare

You add one record at the root of your domain in Cloudflare: type CAA, flags 0, tag issue, and the bare domain of the authority that issues your certificate, one entry per authority. Cloudflare is the DNS host that answers lookups for the domain and, when traffic is proxied through it, the party issuing the edge certificate the browser sees. It does not decide which certificate authorities are allowed to issue for the domain; that is what the CAA record you add sets out.

The record comes first on this page, because the value is the part people get wrong, then the clicks in Cloudflare, then how to prove it’s live before the next renewal comes round.

The record, before the console

A CAA record (Certification Authority Authorization) is a DNS record naming which certificate authorities may issue a certificate for your domain. The rules a publicly trusted authority signs up to require it to look the record up before issuing, and to refuse when it isn’t named there. It’s read only at issuance and renewal, so publishing one changes nothing about the certificate serving your site today.

On the wire the record has three parts: a flags number, a tag, and a value in double quotes. The entry most domains need reads 0 issue "letsencrypt.org", with your own authority in place of that one. In Cloudflare it looks like this:

letsencrypt.org

Flags is 0 for an ordinary entry. Setting it to 128 marks the entry critical, which tells an authority that doesn’t understand the tag to refuse rather than carry on. The three tags below are understood by any authority that checks CAA at all, so 0 is the right choice unless you have a specific reason.

The tag says what the entry controls. issue names an authority allowed to issue ordinary certificates for the name and everything under it. issuewild does the same for wildcard certificates (*.yourdomain.com); with no issuewild entry, the issue entries govern wildcards too. iodef takes a mailto: address where an authority can report a request it refused. The value for issue and issuewild is the authority’s bare domain, and a lone ; means nobody, so 0 issue ";" forbids all issuance and 0 issuewild ";" forbids wildcards from anyone.

Start with one issue entry per authority you use and nothing else. Once a renewal has gone through with the record in place, tighten it: add 0 issuewild ";" if you don’t use wildcard certificates, and an iodef entry if you want to hear about requests that were turned away.

Which authority to name

The value has to match the authority that issues your certificate, and that’s the one decision on this page that can hurt you. Click the padlock in your browser, open the certificate, and read the issuer. The identifier to publish is that authority’s domain: letsencrypt.org for Let’s Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert, sectigo.com for Sectigo, globalsign.com for GlobalSign, amazon.com for AWS Certificate Manager.

If a host or CDN provisions the certificate for you, its documentation names the authority it uses, and that’s the one to list.

Most certificates come from one issuer. Of the 212,160,994 certificates the September 2026 census collected, 118,235,223 (55.73%) were issued by Let’s Encrypt, so if you’ve never chosen an authority and your host switched on HTTPS for you, letsencrypt.org is the likeliest answer, and the padlock check confirms it in seconds.

Name an authority you don’t use and leave out the one you do, and nothing breaks on the day you save. It breaks weeks later, when the certificate comes up for renewal, the authority reads the record, finds it isn’t named, and declines. A site that renews on its own then serves an expired certificate with no email to tell you why. So list every authority in use before you save, and if two are in use, publish two entries.

Cloudflare does not publish or manage a CAA record on the domain’s behalf. When the domain is proxied, Cloudflare obtains its own edge certificates through the authorities it uses, but the CAA record itself, including which authorities it names, is left entirely to whoever configures DNS.

Check Cloudflare answers DNS for the domain

An authority finds the record by asking your domain’s nameservers, starting at the exact name on the certificate and climbing one label at a time until it finds a CAA record set or reaches the apex. A record at the root therefore covers www and any other subdomain that doesn’t publish its own, and it has to sit wherever the domain’s DNS is answered from. Saving it in a console the nameservers don’t point at publishes nothing an authority will ever read.

This only works when Cloudflare is answering DNS for the domain. Open the domain in Cloudflare and check the Overview page to confirm Cloudflare is active there. That page confirms the domain’s nameservers point to the Cloudflare nameservers shown in the dashboard. If the nameservers point elsewhere, add the CAA record at whichever provider runs DNS instead.

Add the record in Cloudflare

Type is set to CAA from the type menu. Name takes @ for the root, since Cloudflare appends the domain to whatever is typed there rather than expecting the full domain name. The value field is labelled CA domain name and takes the bare authority domain such as letsencrypt.org, never a URL and never a www prefix. Flags takes 0 for a normal record and Tag is chosen from a menu labelled Only allow specific hostnames rather than typed as raw text. TTL is left on Auto.

  1. Sign in to Cloudflare and select the domain from the account list.
  2. Open the left-hand menu and go to DNS, then Records.
  3. Click Add record to start a new entry.
  4. Set Type to CAA from the type menu.
  5. In the Name field enter @ for the root of the domain, since Cloudflare appends the domain for you.
  6. Set Flags to 0 in the flags field.
  7. Set Tag to Only allow specific hostnames, which is Cloudflare’s label for the issue tag.
  8. Enter the certificate authority’s bare domain in the CA domain name field, for example letsencrypt.org.
  9. Leave TTL set to Auto.
  10. Click Save to publish the record.

Each authority gets its own entry with the same name, flags and tag; only the value changes. The value is the authority’s bare domain, so write letsencrypt.org on its own. If you put https://letsencrypt.org or www.letsencrypt.org there instead, the authority compares it against its own name character for character, finds no match, and issues nothing.

A few things behave differently in Cloudflare:

A saved DNS change on Cloudflare takes a few minutes up to a couple of hours to take effect everywhere. The record appears alongside the domain’s other entries on the DNS, Records page once saved.

When the change shows, run the free scan against the domain; it queries the record the way an authority would and tells you which entries it found.

Confirm it’s live

The scan is one check. The other is to query the record yourself from a machine outside your own network, so you see what an authority sees rather than what the console shows:

dig yourdomain.com CAA +short

The answer should be one line per entry, each in the form 0 issue "letsencrypt.org". An empty answer means the record hasn’t propagated yet or went into the wrong zone, and the nameserver check above is where to look first. A SERVFAIL means the resolver couldn’t get an answer at all; an authority that meets that on a signed zone declines, which makes it a DNSSEC problem, and DNSSEC SERVFAIL covers how to find and fix it.

The record shows in the DNS, Records list with its Type, Name and value once Save has been clicked, so a return visit to that page confirms it saved as entered.

What goes wrong without it, and with it wrong

With no record, any publicly trusted authority may issue for your domain to whoever passes its validation, and validation only proves that the requester controlled the domain’s DNS or web server at that moment. A stale DNS entry pointing at a server you gave up, a compromised hosting login, or a mistake at an authority is enough, and you’d have no say in which authority was involved and no report afterwards.

Most of the internet runs that way. Of the 313,913,664 domains where the September 2026 census ran the CAA check, 309,587,858 (98.6%) publish no CAA record and 4,325,806 (1.4%) do.

With a wrong record, the failure is the lockout above, and it’s reversible: fix the value or add the missing entry, wait for the change to propagate, and ask the authority to retry. Nothing about a CAA record is permanent, and the same dig query shows you when the corrected entry has gone out.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.