Defaults.Exposed › Setup walkthroughs › CAA › Cloudflare

Add a CAA record in Cloudflare

Cloudflare does not give you a text box for this record. It splits CAA (Certification Authority Authorization) into three separate menu fields, and the tag menu reads Only allow specific hostnames where every other console and every other guide says issue. Knowing that before you start saves the first ten minutes.

What the record does

A CAA record names the certificate authorities allowed to issue certificates for your domain. An authority is required to check it before issuing or renewing, and to refuse if the record exists and does not name them.

Two things follow from that, and both get missed. It is consulted only at issuance, so publishing one changes nothing about the certificate serving your site today. And it binds only authorities that follow the rules, which is all the public ones, so it controls legitimate issuance and does nothing against someone who has already compromised your DNS (Domain Name System).

The record is rare. In the October 2026 census, 4,655,247 domains (1.4%) publish a CAA record and 323,848,975 (98.6%) do not, out of 328,504,222 checked.

Which authority to name

You need the authority that actually issues your certificate, and the answer is usually one of a handful. Let’s Encrypt issued 124,837,486 of the 220,264,382 certificates the census observed, 56.68% of them, so letsencrypt.org is the single most likely value.

In Cloudflare it looks like this:

letsencrypt.org

Flags is 0 for an ordinary entry. The value is the bare authority domain, never a URL and never a www prefix.

Check Cloudflare answers DNS for the domain

An authority finds the record by asking your domain’s nameservers, starting at the exact name on the certificate and climbing one label at a time until it finds a CAA record set or reaches the apex. This only works when Cloudflare is answering DNS for the domain.

Open the domain in Cloudflare and check the Overview page to confirm Cloudflare is active there. That page confirms the domain’s nameservers point to the Cloudflare nameservers shown in the dashboard. If the nameservers point elsewhere, add the CAA record at whichever provider runs DNS instead.

Cloudflare answers DNS lookups for the domain and, when traffic is proxied through it, obtains the edge certificate the browser sees. On a domain with no CAA record, Cloudflare publishes none. Once you add any CAA record and the zone uses Universal SSL (Secure Sockets Layer), Cloudflare adds its own CAA records for the authorities it uses for those certificates. Its documentation names Google Trust Services, Let’s Encrypt, SSL.com and Sectigo, and says the list can change. These added records do not appear in the dashboard, but a dig query for the domain’s CAA records shows them. Cloudflare’s documentation says this does not apply to Advanced Certificate Manager certificates.

Add the record in Cloudflare

1. Sign in to Cloudflare and select the domain from the account list.
2. Open the left-hand menu and go to DNS, then Records.
3. Click Add record to start a new entry.
4. Set Type to CAA from the type menu.
5. In the Name field enter @ for the root of the domain, since Cloudflare appends the domain for you.
6. Set Flags to 0 in the flags field.
7. Set Tag to Only allow specific hostnames, which is Cloudflare’s label for the issue tag.
8. Enter the certificate authority’s bare domain in the CA domain name field, for example letsencrypt.org.
9. Click Save and Cloudflare publishes it.

Things that behave differently here

• Cloudflare presents the CAA flags, tag and value as separate menu fields rather than one text string, and the tag menu reads Only allow specific hostnames where other consoles show the raw word issue.
• A CAA record is a pure DNS record on Cloudflare with no orange or grey cloud proxy toggle attached to it.
• When traffic is proxied through Cloudflare on Universal SSL, you do not need to list Cloudflare’s own authorities. Cloudflare adds hidden CAA records for them as soon as the zone has any CAA record, so the dashboard shows fewer records than a dig query returns. If you use Advanced Certificate Manager, Cloudflare’s documentation says the automatic records do not apply, so check which authority issues those certificates and list it yourself.
• Multiple authorities each need their own separate record with the same @ name, the same 0 flags and the same issue tag; only the CA domain name value changes between records, and Cloudflare does not combine them into one entry.
• A record listing only one authority while the certificate renews through a different one makes the next renewal fail silently, with the padlock breaking only when that renewal comes due.

The other two tags

The tag menu offers more than one option, and the other two are worth knowing even if you leave them alone today.

issuewild governs wildcard certificates specifically, the *.yourdomain.com kind. If you publish only issue records, they govern wildcards too. If you publish an issuewild record, it takes over for wildcards entirely and the issue records stop applying to them. The useful consequence is that issuewild ";" with a semicolon as the value forbids wildcard issuance outright while ordinary certificates carry on, which is a reasonable position for a domain that has no need of wildcards.

iodef takes a mailto: address and asks authorities to report a refused request to it. Support is inconsistent and the volume is near zero for most domains, so there is no need to wait on it before publishing the issue record.

The flags field has only two meaningful values. 0 is the ordinary case. 128 is the critical flag, which instructs an authority that does not understand the tag to refuse issuance rather than proceed. Use it deliberately or not at all.

Wait, then confirm

A saved DNS change on Cloudflare takes a few minutes up to a couple of hours to take effect everywhere. The record appears alongside the domain’s other entries on the DNS, Records page once saved, so a return visit to that page confirms it saved as entered.

How the scan grades this record: the CAA record check, with its pass and fail rules and how many domains pass it.

The record is first tested at the next renewal, which is why a wrong value is dangerous: nothing breaks until a certificate needs reissuing, weeks or months later. Check the list against every authority that issues for this domain before you leave the page, including the one your CDN (Content Delivery Network) or load balancer uses on your behalf.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.