How to add a CAA record on Cloudflare
CAA (Certification Authority Authorization) records name the certificate authorities allowed to issue TLS certificates for your domain. Without CAA, any CA in the world may issue for it; with CAA, issuance is scoped to the CAs you actually use.
The critical rule: every CA that issues certificates for your domain — including ones renewing automatically behind a CDN or load balancer — must be listed, or their next renewal will fail. CAs are required to check CAA before issuing.
The record you'll add
TypeCAA
Name@@ means the root of your domain.
Value0 issue "letsencrypt.org"This example authorizes Let's Encrypt. Use the identifier documented by the CA that issues YOUR certificates — the SSL checker below reads your current certificate and generates the matching CAA record.
TTLTTL Auto (300 seconds) is fine.
Steps on Cloudflare
- Log in at dash.cloudflare.com and select your domain.
- Go to DNS → Records.
- Click Add record and pick the record type.
- Enter the Name and Value shown above, then save.
Cloudflare quirks worth knowing
- ⚠Cloudflare adds the double quotes around TXT content itself — paste the value without quotes.
- ⚠TXT and CAA records have no proxy (orange-cloud) option; that's normal.
- ⚠If this zone uses Cloudflare's own edge certificates (Universal SSL), Cloudflare automatically adds CAA records for its certificate authorities once any CAA record exists on the zone. Don't remove those — your Cloudflare-issued certificates depend on them; Cloudflare's certificate-authorities reference lists the current CAs.
Provider steps verified against Cloudflare: Create DNS records on 2026-07-12.
Get the exact record for your domain
The free SSL checker reads your domain's live DNS, flags what's wrong, and generates the precise CAA record to publish — then rechecks to confirm the fix took.
Run the SSL checker →Frequently asked questions
- What goes in the Name field on Cloudflare?
- Enter @ for the root domain. For subdomains, enter just the prefix — Cloudflare appends your domain automatically.
- How long until the record is live?
- TTL Auto (300 seconds) is fine. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- What value do I put in a CAA record?
- Each CA publishes its own CAA identifier: letsencrypt.org for Let's Encrypt, digicert.com for DigiCert (all brands), sectigo.com for Sectigo/ZeroSSL, pki.goog for Google Trust Services, and amazon.com for AWS Certificate Manager. The record format is: 0 issue "identifier".