How to add a CAA DNS record using DomainsFoundry DNS

How do I add a CAA record to my domain to control which certificate authorities can issue SSL certificates?

A Certification Authority Authorisation (CAA) record specifies which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for your domain.

If no CAA record exists, any CA can issue certificates. Adding a CAA record limits certificate issuance to specific CAs, adding an extra layer of security.

1. Sign in to DomainsFoundry Dashboard

  1. Go to DomainsFoundry Dashboard.
  2. Enter your email address and password.
  3. Click Sign in.

2. Open DNS management for your domain

  1. Go to My Domains.
  2. Click the domain you want to manage.
  3. Click Manage DNS in the sidebar.

3. Add your CAA record

  1. Under Add DNS Record, select CAA from the Type drop-down list.

  2. In the Name field, enter @ to apply the record to your domain name, or enter a subdomain.

  3. The Issuer Critical Flag radio buttons let you choose whether unrecognised CAs must treat unknown CAA records as invalid:

    • 0 – CAs may issue certificates even if the CAA record is unrecognised. This is the default.
    • 1 – CAs must not issue certificates if the CAA record is unrecognised.
  4. Under Tag, select the type of CAA record:
    • issue – Authorises a specific CA to issue certificates for your domain.
    • issuewild – Authorises a specific CA to issue wildcard certificates for your domain.
    • iodef – Specifies a URL where CAs may report violations of your CAA policy.
  5. In the Value field, enter the information matching your selected tag:
    • For issue or issuewild: enter the CA domain name (e.g. letsencrypt.org).
    • For iodef: enter a URL (e.g. mailto:security@example.com or http://example.com/report).
  6. Optionally, enter a TTL (Time To Live). On DomainsFoundry DNS, the TTL is fixed at 1 hour and cannot be changed.

  7. Click Add.

Example: Authorise Let’s Encrypt only

To allow only Let’s Encrypt to issue certificates for your domain:

  1. In the Name field, enter @.
  2. Leave Issuer Critical Flag set to 0.
  3. Under Tag, select issue.
  4. In the Value field, enter letsencrypt.org.
  5. Click Add.

Example: Report violations to a security team

To send CAA violation reports to a security team email address:

  1. In the Name field, enter @.
  2. Under Tag, select iodef.
  3. In the Value field, enter mailto:security@example.com.
  4. Click Add.

FAQs

Why should I add a CAA record?
Without a CCA record, any Certificate Authority can issue certificates for your domain. Adding a CAA record restricts which CAs can issue certificates, reducing the risk of unauthorised certificate issuance.

Can I authorise multiple CAs?
Yes. Add a separate issue or issuewild record for each CA.

What happens if I set the flag to 1?
CAs must not issue certificates if the CAA record is unrecognised. If the CA does not understand CAA, it will not issue a certificate.

What is the difference between issue and issuewild?
issue authorises a CA to issue standard certificates. issuewild authorises a CA to issue wildcard certificates. If you want a CA to issue both, add records for both tags.

How long does it take for a CAA record to take effect?
DomainsFoundry DNS updates are instant. CAA records usually propagate within 24 hours. However DNS servers worldwide may cache the record for up to 48 hours.

Can I delete a CAA record?
Yes. In the DNS management page, find the CAA record and click Delete.