Cloudflare
DNS → Records → Add record → Type CAA
Name: @ · Tag: Only allow specific hostnames (issue) · CA domain name: letsencrypt.org
Free tool
Which certificate authorities can issue for your domain?
A CAA record names the certificate authorities allowed to issue an HTTPS certificate for your domain. Without one, any of roughly a hundred authorities can issue a certificate for you, and every browser will trust it. Check yours below. It runs in your browser against public DNS, takes about three seconds, and nothing is stored.
Public DNS only. We do not store what you check here.
How to add a CAA record
Pick the authority you actually buy certificates from. letsencrypt.org below is the common answer; if your certificates come from Sectigo, DigiCert or your host, name that instead. Naming the wrong one makes your next renewal fail.
GoDaddy
Domain portfolio → your domain → DNS → Add → CAA
Name: @ · Flags: 0 · Tag: issue · Value: letsencrypt.org
Namecheap
Domain List → Manage → Advanced DNS → Add New Record → CAA Record
Host: @ · Flags: 0 · Tag: issue · Value: letsencrypt.org
cPanel
Zone Editor → Manage → Add Record → Type CAA
Name: yourdomain.com · Flag: 0 · Tag: issue · Value: letsencrypt.org
Using Cloudflare for certificates as well as DNS? Add pki.goog and ssl.com too, because Cloudflare issues from several authorities on your behalf and a single-issuer record will block renewals.
Questions people ask about CAA
What is a CAA record?
A line in your domain’s DNS naming the certificate authorities allowed to issue HTTPS certificates for you. Without one, any of the roughly one hundred publicly trusted authorities can issue a certificate for your domain, and every browser will accept it.
Is a CAA record required?
Not required, but certificate authorities are obliged to check it. Since September 2017 every public authority must read your CAA record and refuse to issue if it is not named. So the record only works if you publish it.
What happens if I have no CAA record?
Nothing visible, which is why it is usually missed. It means any authority may issue a certificate for your domain to whoever convinces them, and the first you learn of it is when the certificate is already trusted.
Will a CAA record break my existing certificate?
No. CAA is checked when a certificate is issued or renewed, never when a browser connects. An existing certificate keeps working. The risk is forgetting an authority you still use, so the renewal fails later; this checker lists what you have published so you can compare it with who you buy from.
Does CAA cover subdomains?
Yes. A record on example.com applies to www.example.com and every other subdomain unless that subdomain publishes its own. Wildcard certificates are controlled separately with issuewild.
How long does a CAA record take to work?
As long as your DNS time-to-live, usually a few minutes to an hour. Re-run this check afterwards and you will see it.