A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities may issue certificates for your domain. Every public CA must check it before issuing. It is a useful security control, and a common hidden reason why AutoSSL suddenly stops renewing.
Before you start
- Know where your DNS is hosted: on MdmHost (edit in cPanel) or at another provider such as Cloudflare or your registrar.
- Know which CAs you use: the AutoSSL provider for your server, and any CA you buy paid certificates from.
How CAA works
- No CAA record: any CA may issue. This is the default and works fine with AutoSSL.
- One or more CAA records: only the listed CAs may issue. Every other CA must refuse, including the one AutoSSL uses if it is not listed.
- CAs look at the exact name first, then walk up the tree. A CAA record on
example.comalso applies toshop.example.comunless the subdomain has its own.
Check your current records
In cPanel → Domains → Zone Editor click Manage next to the domain and filter by type CAA. From a terminal you can also run:
dig CAA example.com +shortEach line looks like 0 issue "letsencrypt.org". If your DNS is elsewhere, check there; cPanel's zone is ignored when the domain uses other nameservers.
Record format
| Tag | Meaning | Example value |
|---|---|---|
issue | CA allowed to issue normal certificates | letsencrypt.org |
issuewild | CA allowed to issue wildcard certificates | sectigo.com |
iodef | Where CAs report refused requests | mailto:security@example.com |
The flag is normally 0. CA identifiers are published by each CA; common ones include letsencrypt.org, sectigo.com, digicert.com and globalsign.com.
Add CAA records in cPanel
- Open cPanel → Domains → Zone Editor → Manage for the domain.
- Click Add Record and choose type CAA.
- Name: the domain itself, for example
example.com. - Flag
0, Tagissue, Value the CA identifier. - Add one record per CA you want to allow, including the CA your server's AutoSSL uses. Ask support if you are unsure which provider that is.
- Click Save Record.
Warning: Adding a CAA record for only your paid CA blocks AutoSSL. When the paid certificate expires and you do not renew it, the domain falls back to no valid certificate at all.
When AutoSSL fails because of CAA
The AutoSSL log in cPanel → Security → SSL/TLS Status mentions CAA, for example that the record forbids issuance. Either add the AutoSSL provider's identifier as another issue record, or delete the CAA records if you do not need them. Then click Run AutoSSL.
Should you use CAA at all?
CAA reduces the risk of a certificate being mis-issued by an unrelated CA. It suits organisations with strict security policies. For a typical small business site the benefit is small and the risk of blocking renewals is real; if you add CAA, keep the AutoSSL provider listed.
Troubleshooting
- Record added but CA still refuses: DNS caching; wait for the TTL to expire, and check the record at the nameservers actually in use.
- Subdomain fails while the main domain works: a CNAME on the subdomain points to another domain whose CAA applies.
- Wildcard refused: an
issuewildrecord exists without your CA in it.