A domain can publish a DNS record that says which certificate authorities are authorised to issue certificates for it. That record is called CAA, short for Certification Authority Authorization.
Let’s Encrypt’s CAA documentation explains the purpose and the distinction between the issue and issuewild properties. CAA is part of certificate issuance policy. It does not encrypt traffic by itself, configure the web server or automatically revoke a certificate that already exists.
Start with the certificate service you actually use
Before changing records, identify who issues the certificates for the website, CDN, mail service or other relevant endpoints. A hosting dashboard may hide that detail behind an “automatic SSL” switch, but the renewal process still has an issuer.
Check the provider’s current documentation for the required authorisation value. Do not invent it from the company’s display name. Also establish whether wildcard issuance is part of the setup.
Test the policy against the renewal route
A practical change note should list the current records, intended policy, affected services and a verification plan. After an authorised change, confirm the records visible through DNS and test issuance or renewal through the service’s supported process.
For example, a domain may work today with an existing certificate while a newly restrictive CAA policy prevents the next renewal. The page loading successfully immediately after the DNS edit would not prove the future issuance path still works.
CAA lookup errors also deserve investigation rather than a random replacement record. DNS responses, delegation and the provider’s diagnostic message can help establish what the certificate authority was unable to check.
- Record the actual issuer for each service.
- Use the provider’s documented CAA identifiers.
- Review wildcard needs separately.
- Verify issuance and keep renewal monitoring active.
CAA is a useful restriction when it reflects the domain’s real operating arrangements. Treat it as maintained configuration: a later move to another certificate service should trigger a review, just as changing hosting requires checking where the domain points.