CAA Records Explained for SSL Certificates

The practical reason CAA matters

CAA records tell certificate authorities which companies are allowed to issue certificates for a domain. If your domain publishes CAA and your host tries to renew through a CA that is not listed, the renewal can fail even though DNS and hosting otherwise look fine.

This often shows up after moving to a CDN, changing hosting providers, or switching from one certificate service to another. The web server may be ready, but the DNS policy quietly says the new CA is not allowed.

The tags you will usually see

• issue allows a CA to issue normal certificates.
• issuewild controls wildcard certificates such as *.example.com.
• iodef gives a reporting address for policy problems.

Before changing CAA

Do not delete CAA records blindly. First identify which CA your host, CDN, or certificate manager actually uses. Then make the smallest policy change that allows legitimate issuance. If you use both a CDN and a separate mail or app platform, confirm whether subdomains need different certificate workflows.

A common renewal failure pattern

The certificate panel says validation failed, the DNS A record looks correct, and the site still serves the old certificate. In that case, check CAA before chasing unrelated DNS records. A restrictive CAA policy can block issuance while the rest of the setup appears healthy.

Tools to use

Use DNS Lookup to inspect CAA records and SSL Certificate Checker to check browser HTTPS reachability. For critical sites, confirm the final certificate in your host or CDN dashboard.