A CAA record identifies which certificate authorities may issue certificates for a hostname. It does not install an SSL certificate or connect your website. If your host reports a CAA error, check the active DNS policy and the certificate authority that host currently uses. Follow the host’s required values rather than adding a random example or deleting every existing permission.
Before you begin
- The exact hostname and certificate error reported by your website host.
- The host’s current list of permitted certificate authorities and required CAA values.
- Access to the authoritative DNS zone and a saved copy of its records.
- Confirmation of whether the certificate covers a normal hostname or a wildcard.
What CAA changes — and what it leaves alone
Certificate Authority Authorization is a DNS policy for certificate issuance. It is separate from the A, AAAA and CNAME records used to reach a website. It is also separate from MX records, which route incoming email. Publishing CAA does not move a website, buy a certificate or enable HTTPS by itself.
An issuer checks the relevant policy before issuing a certificate. A website can therefore appear to work today while an unsuitable CAA policy prevents a later certificate renewal. Treat the policy as something to review when changing website hosts or certificate arrangements, not as a badge to add without understanding the values.
Sources: Let’s Encrypt: CAA permissions and errors ↗ · Cloudflare: CAA records and certificate authorities ↗
Read the flags, tag and value
A CAA value contains flags, a property tag and the authority information. The common issue tag controls ordinary issuance and also wildcard issuance when no issuewild property supplies a separate wildcard policy. The issuewild tag controls wildcard permission. Do not assume the two tags always mean the same thing.
For example, 0 issue "letsencrypt.org" is a permission for Let’s Encrypt. It is an example, not the correct setup for every host. Multiple issuer permissions can be appropriate. Keep the complete set required by your hosting provider and its fallback certificate arrangements.
| Field | What to confirm |
|---|---|
| Flags | Use the host’s documented value; 0 is common. |
| Tag | Check whether issue or issuewild is intended. |
| Authority value | Use the certificate authority identifier supplied by the host. |
| Hostname | Confirm which root or subdomain the policy affects. |
Sources: Let’s Encrypt: CAA permissions and errors ↗ · IETF: DNS Certification Authority Authorization (RFC 8659) ↗
Find the policy at the active DNS host
Start with the domain’s current nameservers. If NameUK’s managed nameservers are active, open the domain’s DNS records here and review its CAA entries. If the domain uses an external DNS service, inspect that service instead. An unused DNS zone can show a perfectly reasonable policy that certificate issuers never see.
Save a record snapshot before editing. Note the hostname, existing values and time of the proposed change. Ask the website host which authority it is trying to use for the failing certificate and whether it needs more than one issuer permission. Sharing the error text and hostname is more useful than repeatedly retrying issuance without checking the policy.
Check subdomains and CNAME destinations too
CAA can be inherited from higher in the DNS name hierarchy, and a closer applicable policy can change the answer for a subdomain. CNAME processing also matters. Looking only at the root domain’s list is not always enough to explain the effective permission for a hostname such as shop.example.co.uk.
Cloudflare documents that restrictive CAA at a CNAME target can affect issuance. Give the hosting provider the complete hostname and alias destination when asking for help. Do not add incompatible records alongside a CNAME just to try to override its destination’s policy.
Sources: Let’s Encrypt: CAA permissions and errors ↗ · Cloudflare: CAA records and certificate authorities ↗
Make a targeted change and confirm issuance
In NameUK’s managed DNS editor, choose CAA and use the complete supported value format shown by the form: flags, tag and value. Review the hostname and any existing records before saving. Keep unrelated website, email and verification records in place.
After the DNS change is published, return to the website host’s certificate check. Confirm that the requested certificate has actually been issued and that HTTPS loads without a warning. A saved DNS entry is not proof of successful certificate issuance. Record the final policy so someone can review it again during the next hosting move.
What if there are no CAA records or the error remains?
Not having a CAA restriction is different from DNS failing to answer a CAA query. Let’s Encrypt notes that DNS errors can prevent an issuer from determining whether it is permitted to issue, even when no CAA policy has deliberately been configured. Check for DNS failures and DNSSEC validation problems rather than blindly adding a record.
Keep domain renewal separate from certificate renewal. Renewing your domain maintains the registration; it does not fix a certificate-policy error at the website host. NameUK’s current low-cost UK registration and renewal offer is below, while your website provider remains the reference for its certificate requirements.
Reviewed against the linked primary guidance on 15 October 2026. Check current provider instructions and extension rules before making changes.
Further readingLet’s Encrypt: CAA permissions and errors ↗Cloudflare: CAA records and certificate authorities ↗IETF: DNS Certification Authority Authorization (RFC 8659) ↗Extension rules and provider processes can change. Check the current registrar instructions before a registration, transfer or renewal.
Low-cost registration. Affordable UK renewals.
Register .co.uk for £9.99 for one year, with annual renewal currently £9.99. Or choose a new three-year .co.uk registration for £25.99. Check the selected name and term before payment. Future renewal prices can change.