Defaults.Exposed

Add a CAA record on Namecheap

You add one record at the root of your domain in Namecheap: type CAA, flags 0, tag issue, and the bare domain of the authority that issues your certificate, one entry per authority. Namecheap is the DNS host for this record when the domain uses Namecheap BasicDNS or PremiumDNS. It holds the CAA record in Host Records and answers queries for it, and it does not choose or validate which certificate authority you list.

The record comes first on this page, because the value is the part people get wrong, then the clicks in Namecheap, then how to prove it’s live before the next renewal comes round.

The record, before the console

A CAA record (Certification Authority Authorization) is a DNS record naming which certificate authorities may issue a certificate for your domain. The rules a publicly trusted authority signs up to require it to look the record up before issuing, and to refuse when it isn’t named there. It’s read only at issuance and renewal, so publishing one changes nothing about the certificate serving your site today.

On the wire the record has three parts: a flags number, a tag, and a value in double quotes. The entry most domains need reads 0 issue "letsencrypt.org", with your own authority in place of that one. In Namecheap it looks like this:

Host: @
Flag: 0
Tag: issue
Value: letsencrypt.org

Flags is 0 for an ordinary entry. Setting it to 128 marks the entry critical, which tells an authority that doesn’t understand the tag to refuse rather than carry on. The three tags below are understood by any authority that checks CAA at all, so 0 is the right choice unless you have a specific reason.

The tag says what the entry controls. issue names an authority allowed to issue ordinary certificates for the name and everything under it. issuewild does the same for wildcard certificates (*.yourdomain.com); with no issuewild entry, the issue entries govern wildcards too. iodef takes a mailto: address where an authority can report a request it refused. The value for issue and issuewild is the authority’s bare domain, and a lone ; means nobody, so 0 issue ";" forbids all issuance and 0 issuewild ";" forbids wildcards from anyone.

Start with one issue entry per authority you use and nothing else. Once a renewal has gone through with the record in place, tighten it: add 0 issuewild ";" if you don’t use wildcard certificates, and an iodef entry if you want to hear about requests that were turned away.

Which authority to name

The value has to match the authority that issues your certificate, and that’s the one decision on this page that can hurt you. Click the padlock in your browser, open the certificate, and read the issuer. The identifier to publish is that authority’s domain: letsencrypt.org for Let’s Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert, sectigo.com for Sectigo, globalsign.com for GlobalSign, amazon.com for AWS Certificate Manager.

If a host or CDN provisions the certificate for you, its documentation names the authority it uses, and that’s the one to list.

Most certificates come from one issuer. Of the 212,160,994 certificates the September 2026 census collected, 118,235,223 (55.73%) were issued by Let’s Encrypt, so if you’ve never chosen an authority and your host switched on HTTPS for you, letsencrypt.org is the likeliest answer, and the padlock check confirms it in seconds.

Name an authority you don’t use and leave out the one you do, and nothing breaks on the day you save. It breaks weeks later, when the certificate comes up for renewal, the authority reads the record, finds it isn’t named, and declines. A site that renews on its own then serves an expired certificate with no email to tell you why. So list every authority in use before you save, and if two are in use, publish two entries.

Namecheap publishes exactly the CAA record entered into Host Records once it is saved and Save All Changes is confirmed. It does not add, infer or validate a certificate authority on the reader’s behalf, and it does not check whether the listed authority matches the one issuing the certificate.

Check Namecheap answers DNS for the domain

An authority finds the record by asking your domain’s nameservers, starting at the exact name on the certificate and climbing one label at a time until it finds a CAA record set or reaches the apex. A record at the root therefore covers www and any other subdomain that doesn’t publish its own, and it has to sit wherever the domain’s DNS is answered from. Saving it in a console the nameservers don’t point at publishes nothing an authority will ever read.

Sign in to Namecheap, open Domain List, and click Manage next to the domain. Check the nameservers shown there against Namecheap BasicDNS or PremiumDNS. If they match, Advanced DNS is where this record lives. If the nameservers point elsewhere, the CAA record goes at whichever provider those nameservers name, not here.

Add the record in Namecheap

Pick CAA Record from the Type dropdown; Namecheap has a dedicated type for it, so you don’t hand-write the value into a TXT record. Enter @ in the Host field and Namecheap appends the domain at the root for you, so leave the domain name itself out. Enter 0 in Flag for the ordinary case, and put the authority’s bare identifier, such as letsencrypt.org, in Value (CA domain), with no URL scheme and no www in front. Leave TTL on the Automatic setting.

  1. Sign in to Namecheap and open Domain List.
  2. Click Manage next to the domain.
  3. Open the Advanced DNS tab.
  4. Under Host Records, click Add New Record.
  5. Set the record Type to CAA Record from the dropdown.
  6. In the Host field, enter @, which stands for the root of the domain. If you type the domain name itself here, the record lands in the wrong place.
  7. In the Flag field, enter 0.
  8. In the Tag field, choose issue.
  9. In the Value (CA domain) field, enter the certificate authority’s identifier, for example letsencrypt.org.
  10. Leave TTL on Automatic, click the green tick to save, then click Save All Changes if prompted.

Each authority gets its own entry with the same name, flags and tag; only the value changes. The value is the authority’s bare domain, so write letsencrypt.org on its own. If you put https://letsencrypt.org or www.letsencrypt.org there instead, the authority compares it against its own name character for character, finds no match, and issues nothing.

A few things behave differently in Namecheap:

Once you’ve saved, the record shows as a row under Host Records in the Advanced DNS tab, and nothing reads it until an authority next issues or renews a certificate for the domain.

When the change shows, run the free scan against the domain; it queries the record the way an authority would and tells you which entries it found.

Confirm it’s live

The scan is one check. The other is to query the record yourself from a machine outside your own network, so you see what an authority sees rather than what the console shows:

dig yourdomain.com CAA +short

The answer should be one line per entry, each in the form 0 issue "letsencrypt.org". An empty answer means the record hasn’t propagated yet or went into the wrong zone, and the nameserver check above is where to look first. A SERVFAIL means the resolver couldn’t get an answer at all; an authority that meets that on a signed zone declines, which makes it a DNSSEC problem, and DNSSEC SERVFAIL covers how to find and fix it.

What goes wrong without it, and with it wrong

With no record, any publicly trusted authority may issue for your domain to whoever passes its validation, and validation only proves that the requester controlled the domain’s DNS or web server at that moment. A stale DNS entry pointing at a server you gave up, a compromised hosting login, or a mistake at an authority is enough, and you’d have no say in which authority was involved and no report afterwards.

Most of the internet runs that way. Of the 313,913,664 domains where the September 2026 census ran the CAA check, 309,587,858 (98.6%) publish no CAA record and 4,325,806 (1.4%) do.

With a wrong record, the failure is the lockout above, and it’s reversible: fix the value or add the missing entry, wait for the change to propagate, and ask the authority to retry. Nothing about a CAA record is permanent, and the same dig query shows you when the corrected entry has gone out.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.