Defaults.Exposed › Setup walkthroughs › CAA › AWS Route 53

Route 53 CAA record, step by step

Route 53 wants the whole record as one line in a single Value box, quotes included: 0 issue "letsencrypt.org". Leave the double quotes off and the record is invalid. This is the format most guides do not show you, because most consoles split the three parts into separate fields.

What the record does, and its limits

A CAA (Certification Authority Authorization) record names the certificate authorities allowed to issue for your domain. Any authority that follows the rules checks it before issuing or renewing, and refuses if a record exists that does not name it.

It blocks nothing already issued and revokes nothing. It binds only authorities that check it, and only at issuance or renewal, so a certificate serving your site right now is unaffected by anything you publish today.

Publishing one puts you in a small group. The October 2026 census found 4,655,247 domains (1.4%) with a CAA record against 323,848,975 (98.6%) without, out of 328,504,222 checked.

In Route 53 it looks like this:

0 issue "letsencrypt.org"

Flags is 0 for an ordinary entry.

The AWS-specific trap: ACM needs amazon.com

If certificates come from AWS Certificate Manager and the record does not include amazon.com, ACM validation and renewal fail. This is the Route 53 specific trip-up, and it is easy to hit because ACM certificates renew automatically, so nobody is watching when the failure arrives.

An AWS-hosted site commonly has more than one authority in play: ACM for the load balancer or CloudFront distribution, and something else for anything terminating TLS (Transport Layer Security) outside AWS. Let’s Encrypt is the most likely second name, having issued 124,837,486 of 220,264,382 certificates observed in the census, 56.68%. List every one of them.

Each additional authority goes on its own line inside the same Value box.

Check Route 53 answers DNS for the domain

An authority finds the record by asking your domain’s nameservers, starting at the exact name on the certificate and climbing one label at a time until it finds a CAA record set or reaches the apex.

Records in Route 53 live inside a hosted zone for the domain, and that zone only answers for the domain when the domain’s nameservers at the registrar point at the four Route 53 nameservers listed in the zone’s NS record. Open the hosted zone and check its NS record against what the registrar has set. If the registrar points elsewhere, add the CAA record at whichever provider runs DNS (Domain Name System) for the domain instead.

Route 53 is the DNS host inside the AWS Management Console where the domain’s hosted zone lives. It publishes the CAA record once you create it, and it does not add or infer any authority on its own or check which authority your certificates renew through.

Add the record in Route 53

1. Sign in to the AWS Management Console and open Route 53.
2. In the left menu, choose Hosted zones, then select your domain.
3. Click Create record to start a new entry.
4. Leave the Record name field empty so the record applies at the apex of the domain.
5. Set Record type to CAA.
6. In the Value box, enter the record on one line as 0 issue "letsencrypt.org", adding a further line for each additional authority.
7. Leave TTL (Time to Live) at the default of 300 seconds.
8. Choose Simple routing if the console asks for a routing policy, then click Create records.

Things that behave differently here

• A CAA record that lists only an authority you do not renew through makes the next renewal fail silently, weeks later. Include every authority the domain uses before saving.
• The double quotes around the authority are required in Route 53’s format. Leaving them off makes the record invalid.
• Typing the domain name into the Record name field creates the record away from the apex.
• Flags is 0 for a normal record. 128 is a strict mode, used only deliberately.
• The value is the bare domain, letsencrypt.org, never https://letsencrypt.org and never a www. form.

Wildcards and subdomains

Two behaviours decide how far this record reaches, and both matter more on AWS than elsewhere because subdomains proliferate.

The lookup climbs. An authority asked to issue for api.yourdomain.com looks for a record set at that exact name, and only if it finds none does it try yourdomain.com. So an apex record covers every subdomain without one, and a subdomain with its own record overrides the apex entirely for that name, meaning the full list has to be repeated there rather than just the difference.

Wildcards have their own tag. issuewild governs *.yourdomain.com certificates, and when it is present it replaces issue for wildcards completely. Publish only issue records and wildcards are governed by them. A line of 0 issuewild ";" forbids wildcard issuance outright while ordinary certificates continue, which suits a domain that has no wildcard requirement.

The third tag, iodef, takes a mailto: address and asks authorities to report refused requests to it. Support is patchy, so treat it as optional.

Wait, then confirm

The change takes minutes to a couple of hours to take effect. The saved record appears in the hosted zone’s record list under the domain in Route 53. Open that list and confirm the CAA entry shows the type, name and value you entered, quotes included.

How the scan grades this record: the CAA record check, with its pass and fail rules and how many domains pass it.

Nothing exercises this record until the next issuance, so check the list of authorities now: a record that saved cleanly can still name the wrong ones.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.