Add a CAA record in GoDaddy

You add one record at the root of your domain in GoDaddy: type CAA, flags 0, tag issue, and the bare domain of the authority that issues your certificate, one entry per authority. GoDaddy sells domains and also hosts DNS as two separate products. It is the DNS host you use here only when your domain’s nameservers point at GoDaddy, and it is not itself a certificate authority.

The record comes first on this page, because the value is the part people get wrong, then the clicks in GoDaddy, then how to prove it’s live before the next renewal comes round.

The record, before the console

A CAA record (Certification Authority Authorization) is a DNS record naming which certificate authorities may issue a certificate for your domain. The rules a publicly trusted authority signs up to require it to look the record up before issuing, and to refuse when it isn’t named there. It’s read only at issuance and renewal, so publishing one changes nothing about the certificate serving your site today.

On the wire the record has three parts: a flags number, a tag, and a value in double quotes. The entry most domains need reads 0 issue "letsencrypt.org", with your own authority in place of that one. In GoDaddy it looks like this:

Type: CAA
Name (Host): @
Flags: 0
Tag: issue
Value: letsencrypt.org

Flags is 0 for an ordinary entry. Setting it to 128 marks the entry critical, which tells an authority that doesn’t understand the tag to refuse rather than carry on. The three tags below are understood by any authority that checks CAA at all, so 0 is the right choice unless you have a specific reason.

The tag says what the entry controls. issue names an authority allowed to issue ordinary certificates for the name and everything under it. issuewild does the same for wildcard certificates (*.yourdomain.com); with no issuewild entry, the issue entries govern wildcards too. iodef takes a mailto: address where an authority can report a request it refused. The value for issue and issuewild is the authority’s bare domain, and a lone ; means nobody, so 0 issue ";" forbids all issuance and 0 issuewild ";" forbids wildcards from anyone.

Start with one issue entry per authority you use and nothing else. Once a renewal has gone through with the record in place, tighten it: add 0 issuewild ";" if you don’t use wildcard certificates, and an iodef entry if you want to hear about requests that were turned away.

Which authority to name

The value has to match the authority that issues your certificate, and that’s the one decision on this page that can hurt you. Click the padlock in your browser, open the certificate, and read the issuer. The identifier to publish is that authority’s domain: letsencrypt.org for Let’s Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert, sectigo.com for Sectigo, globalsign.com for GlobalSign, amazon.com for AWS Certificate Manager.

If a host or CDN provisions the certificate for you, its documentation names the authority it uses, and that’s the one to list.

Most certificates come from one issuer. Of the 212,160,994 certificates the September 2026 census collected, 118,235,223 (55.73%) were issued by Let’s Encrypt, so if you’ve never chosen an authority and your host switched on HTTPS for you, letsencrypt.org is the likeliest answer, and the padlock check confirms it in seconds.

Name an authority you don’t use and leave out the one you do, and nothing breaks on the day you save. It breaks weeks later, when the certificate comes up for renewal, the authority reads the record, finds it isn’t named, and declines. A site that renews on its own then serves an expired certificate with no email to tell you why. So list every authority in use before you save, and if two are in use, publish two entries.

GoDaddy publishes exactly what is entered into the Type, Name, Flags, Tag and Value fields once Save is clicked. It does not choose or suggest a certificate authority, so the reader has to find out which one issues their certificate before filling in the Value field.

Check GoDaddy answers DNS for the domain

An authority finds the record by asking your domain’s nameservers, starting at the exact name on the certificate and climbing one label at a time until it finds a CAA record set or reaches the apex. A record at the root therefore covers www and any other subdomain that doesn’t publish its own, and it has to sit wherever the domain’s DNS is answered from. Saving it in a console the nameservers don’t point at publishes nothing an authority will ever read.

Sign in to GoDaddy, open your domain and check that the nameservers listed are GoDaddy’s own. Records added on GoDaddy’s DNS management page are only live if those nameservers are the ones the domain uses. If they point somewhere else, add the CAA record at whichever provider runs the domain’s DNS instead.

Add the record in GoDaddy

Set Type to CAA. Enter @ in the Name field, which GoDaddy also labels Host, so the record sits at the root of the domain rather than under a typed-out domain name. Set Flags to 0 and Tag to issue, then put the certificate authority’s bare domain, such as letsencrypt.org, in the Value field. Leave TTL on GoDaddy’s default of one hour.

1. Sign in to GoDaddy and open the Domain Portfolio, or My Products.
2. Find the domain and open its DNS management page, labelled DNS or Manage DNS.
3. Under the records list, click Add, or Add New Record.
4. Set the Type field to CAA.
5. In the Name field, also labelled Host, enter @, which means the root of the domain, and do not type the domain name in here.
6. Set the Flags field to 0.
7. Set the Tag field to issue.
8. In the Value field, enter the certificate authority’s identifier, for example letsencrypt.org.
9. Leave TTL on the default, since one hour is fine.
10. Click Save to publish the record.

Each authority gets its own entry with the same name, flags and tag; only the value changes. The value is the authority’s bare domain, so write letsencrypt.org on its own. If you put https://letsencrypt.org or www.letsencrypt.org there instead, the authority compares it against its own name character for character, finds no match, and issues nothing.

A few things behave differently in GoDaddy:

• The Name field takes @ for the root, not the domain name typed out in full; typing the domain name there creates the record in the wrong place.
• Flags takes 0 for ordinary use. The other value, 128, is the critical flag, which makes an authority that does not understand the tag refuse to issue, so use it deliberately or not at all.
• The Value field takes the bare domain, such as letsencrypt.org, never https://letsencrypt.org and never a www form.
• Do not add quotes around the value in the Value field. GoDaddy handles any quoting itself.
• To allow more than one authority, add a separate record for each with the same @ name, 0 flags and issue tag, changing only the Value field. GoDaddy does not combine multiple authorities into a single record.

A saved record can take a few minutes up to a couple of hours to take effect at GoDaddy. It appears in the same records list on the DNS management page where Add was clicked.

When the change shows, run the free scan against the domain; it queries the record the way an authority would and tells you which entries it found.

Confirm it’s live

The scan is one check. The other is to query the record yourself from a machine outside your own network, so you see what an authority sees rather than what the console shows:

dig yourdomain.com CAA +short

The answer should be one line per entry, each in the form 0 issue "letsencrypt.org". An empty answer means the record hasn’t propagated yet or went into the wrong zone, and the nameserver check above is where to look first. A SERVFAIL means the resolver couldn’t get an answer at all; an authority that meets that on a signed zone declines, which makes it a DNSSEC problem, and DNSSEC SERVFAIL covers how to find and fix it.

What goes wrong without it, and with it wrong

With no record, any publicly trusted authority may issue for your domain to whoever passes its validation, and validation only proves that the requester controlled the domain’s DNS or web server at that moment. A stale DNS entry pointing at a server you gave up, a compromised hosting login, or a mistake at an authority is enough, and you’d have no say in which authority was involved and no report afterwards.

Most of the internet runs that way. Of the 313,913,664 domains where the September 2026 census ran the CAA check, 309,587,858 (98.6%) publish no CAA record and 4,325,806 (1.4%) do.

With a wrong record, the failure is the lockout above, and it’s reversible: fix the value or add the missing entry, wait for the change to propagate, and ask the authority to retry. Nothing about a CAA record is permanent, and the same dig query shows you when the corrected entry has gone out.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.