Defaults.Exposed

Route 53 CAA record, step by step

You add one record at the root of your domain in AWS Route 53: type CAA, flags 0, tag issue, and the bare domain of the authority that issues your certificate, one entry per authority. Route 53 is the DNS host inside the AWS Management Console where the domain’s hosted zone lives. It publishes the CAA record once you create it, but it does not decide which certificate authorities you use, that is a fact about your own certificates.

The record comes first on this page, because the value is the part people get wrong, then the clicks in AWS Route 53, then how to prove it’s live before the next renewal comes round.

The record, before the console

A CAA record (Certification Authority Authorization) is a DNS record naming which certificate authorities may issue a certificate for your domain. The rules a publicly trusted authority signs up to require it to look the record up before issuing, and to refuse when it isn’t named there. It’s read only at issuance and renewal, so publishing one changes nothing about the certificate serving your site today.

On the wire the record has three parts: a flags number, a tag, and a value in double quotes. The entry most domains need reads 0 issue "letsencrypt.org", with your own authority in place of that one. In AWS Route 53 it looks like this:

0 issue "letsencrypt.org"

Flags is 0 for an ordinary entry. Setting it to 128 marks the entry critical, which tells an authority that doesn’t understand the tag to refuse rather than carry on. The three tags below are understood by any authority that checks CAA at all, so 0 is the right choice unless you have a specific reason.

The tag says what the entry controls. issue names an authority allowed to issue ordinary certificates for the name and everything under it. issuewild does the same for wildcard certificates (*.yourdomain.com); with no issuewild entry, the issue entries govern wildcards too. iodef takes a mailto: address where an authority can report a request it refused. The value for issue and issuewild is the authority’s bare domain, and a lone ; means nobody, so 0 issue ";" forbids all issuance and 0 issuewild ";" forbids wildcards from anyone.

Start with one issue entry per authority you use and nothing else. Once a renewal has gone through with the record in place, tighten it: add 0 issuewild ";" if you don’t use wildcard certificates, and an iodef entry if you want to hear about requests that were turned away.

Which authority to name

The value has to match the authority that issues your certificate, and that’s the one decision on this page that can hurt you. Click the padlock in your browser, open the certificate, and read the issuer. The identifier to publish is that authority’s domain: letsencrypt.org for Let’s Encrypt, pki.goog for Google Trust Services, digicert.com for DigiCert, sectigo.com for Sectigo, globalsign.com for GlobalSign, amazon.com for AWS Certificate Manager.

If a host or CDN provisions the certificate for you, its documentation names the authority it uses, and that’s the one to list.

Most certificates come from one issuer. Of the 212,160,994 certificates the September 2026 census collected, 118,235,223 (55.73%) were issued by Let’s Encrypt, so if you’ve never chosen an authority and your host switched on HTTPS for you, letsencrypt.org is the likeliest answer, and the padlock check confirms it in seconds.

Name an authority you don’t use and leave out the one you do, and nothing breaks on the day you save. It breaks weeks later, when the certificate comes up for renewal, the authority reads the record, finds it isn’t named, and declines. A site that renews on its own then serves an expired certificate with no email to tell you why. So list every authority in use before you save, and if two are in use, publish two entries.

Route 53 publishes exactly the CAA record you enter in the Value box, on the hosted zone you selected, once you click Create records. It does not add or infer any authority on its own, and it does not check which certificate authority your certificates renew through.

Check AWS Route 53 answers DNS for the domain

An authority finds the record by asking your domain’s nameservers, starting at the exact name on the certificate and climbing one label at a time until it finds a CAA record set or reaches the apex. A record at the root therefore covers www and any other subdomain that doesn’t publish its own, and it has to sit wherever the domain’s DNS is answered from. Saving it in a console the nameservers don’t point at publishes nothing an authority will ever read.

Records in Route 53 live inside a hosted zone for the domain, and that zone only answers for the domain when the domain’s nameservers at the registrar point at the four Route 53 nameservers listed in the zone’s NS record. Open the hosted zone and check its NS record against what the registrar has set. If the registrar points elsewhere, add the CAA record at whichever provider runs DNS for the domain instead.

Add the record in AWS Route 53

Record name stays empty so the record sits at the apex, since typing the domain name into that field creates the record in the wrong place. Record type is set to CAA. The Value box carries the full three-part line, flags, tag and the authority in double quotes, for example 0 issue "letsencrypt.org", and each additional authority goes on its own extra line inside the same box rather than joined onto one line. TTL is left at the Route 53 default of 300 seconds.

  1. Sign in to the AWS Management Console and open Route 53.
  2. In the left menu, choose Hosted zones, then select your domain.
  3. Click Create record to start a new entry.
  4. Leave the Record name field empty so the record applies at the apex of the domain.
  5. Set Record type to CAA.
  6. In the Value box, enter the record on one line as 0 issue "letsencrypt.org".
  7. Leave TTL at the default of 300 seconds.
  8. Choose Simple routing if the console asks for a routing policy, then click Create records.

Each authority gets its own entry with the same name, flags and tag; only the value changes. The value is the authority’s bare domain, so write letsencrypt.org on its own. If you put https://letsencrypt.org or www.letsencrypt.org there instead, the authority compares it against its own name character for character, finds no match, and issues nothing.

A few things behave differently in AWS Route 53:

The change takes minutes to a couple of hours to take effect. The saved record appears in the hosted zone’s record list under the domain in Route 53.

When the change shows, run the free scan against the domain; it queries the record the way an authority would and tells you which entries it found.

Confirm it’s live

The scan is one check. The other is to query the record yourself from a machine outside your own network, so you see what an authority sees rather than what the console shows:

dig yourdomain.com CAA +short

The answer should be one line per entry, each in the form 0 issue "letsencrypt.org". An empty answer means the record hasn’t propagated yet or went into the wrong zone, and the nameserver check above is where to look first. A SERVFAIL means the resolver couldn’t get an answer at all; an authority that meets that on a signed zone declines, which makes it a DNSSEC problem, and DNSSEC SERVFAIL covers how to find and fix it.

Open the hosted zone’s record list and confirm the CAA entry shows the type, name and value you entered.

What goes wrong without it, and with it wrong

With no record, any publicly trusted authority may issue for your domain to whoever passes its validation, and validation only proves that the requester controlled the domain’s DNS or web server at that moment. A stale DNS entry pointing at a server you gave up, a compromised hosting login, or a mistake at an authority is enough, and you’d have no say in which authority was involved and no report afterwards.

Most of the internet runs that way. Of the 313,913,664 domains where the September 2026 census ran the CAA check, 309,587,858 (98.6%) publish no CAA record and 4,325,806 (1.4%) do.

With a wrong record, the failure is the lockout above, and it’s reversible: fix the value or add the missing entry, wait for the change to propagate, and ask the authority to retry. Nothing about a CAA record is permanent, and the same dig query shows you when the corrected entry has gone out.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.