How to add a CAA record on GoDaddy
CAA (Certification Authority Authorization) records name the certificate authorities allowed to issue TLS certificates for your domain. Without CAA, any CA in the world may issue for it; with CAA, issuance is scoped to the CAs you actually use.
The critical rule: every CA that issues certificates for your domain — including ones renewing automatically behind a CDN or load balancer — must be listed, or their next renewal will fail. CAs are required to check CAA before issuing.
The record you'll add
TypeCAA
Name@@ means the root of your domain.
Value0 issue "letsencrypt.org"This example authorizes Let's Encrypt. Use the identifier documented by the CA that issues YOUR certificates — the SSL checker below reads your current certificate and generates the matching CAA record.
TTLThe default TTL (1 hour) is fine; GoDaddy says most updates take effect within an hour, up to 48 hours globally.
Steps on GoDaddy
- Sign in at godaddy.com and open your Domain Portfolio.
- Select the domain, then open the DNS tab.
- Click Add New Record and choose the record type.
- Enter @ (root) or the prefix shown above as the Name, paste the Value, and save.
GoDaddy quirks worth knowing
- ⚠GoDaddy caps TXT values at 1,024 characters — fine for SPF and DMARC, but long DKIM keys can hit it.
- ⚠Don't paste quotes into the Value field; GoDaddy handles quoting.
- ⚠GoDaddy's CAA form has separate Flags / Tag / Value fields: enter Flags 0, Tag issue, and the CA identifier (without quotes) as the Value.
Provider steps verified against GoDaddy: Add a TXT record on 2026-07-12.
Get the exact record for your domain
The free SSL checker reads your domain's live DNS, flags what's wrong, and generates the precise CAA record to publish — then rechecks to confirm the fix took.
Run the SSL checker →Frequently asked questions
- What goes in the Name field on GoDaddy?
- Enter @ for the root domain. For subdomains, enter just the prefix — GoDaddy appends your domain automatically.
- How long until the record is live?
- The default TTL (1 hour) is fine; GoDaddy says most updates take effect within an hour, up to 48 hours globally. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- What value do I put in a CAA record?
- Each CA publishes its own CAA identifier: letsencrypt.org for Let's Encrypt, digicert.com for DigiCert (all brands), sectigo.com for Sectigo/ZeroSSL, pki.goog for Google Trust Services, and amazon.com for AWS Certificate Manager. The record format is: 0 issue "identifier".