How to add a CAA record on Namecheap
CAA (Certification Authority Authorization) records name the certificate authorities allowed to issue TLS certificates for your domain. Without CAA, any CA in the world may issue for it; with CAA, issuance is scoped to the CAs you actually use.
The critical rule: every CA that issues certificates for your domain — including ones renewing automatically behind a CDN or load balancer — must be listed, or their next renewal will fail. CAs are required to check CAA before issuing.
The record you'll add
TypeCAA
Host@@ means the root of your domain.
Value0 issue "letsencrypt.org"This example authorizes Let's Encrypt. Use the identifier documented by the CA that issues YOUR certificates — the SSL checker below reads your current certificate and generates the matching CAA record.
TTLThe default "Automatic" TTL (30 minutes) is fine; changes are typically live within 30 minutes.
Steps on Namecheap
- Sign in at namecheap.com and open Domain List → Manage next to your domain.
- Open the Advanced DNS tab.
- Under Host Records, click Add New Record and choose the record type.
- Enter @ (root) or the prefix shown above as the Host — never include your domain name itself — paste the Value, and save.
Provider steps verified against Namecheap: Add TXT/SPF/DKIM/DMARC records on 2026-07-12.
Get the exact record for your domain
The free SSL checker reads your domain's live DNS, flags what's wrong, and generates the precise CAA record to publish — then rechecks to confirm the fix took.
Run the SSL checker →Frequently asked questions
- What goes in the Host field on Namecheap?
- Enter @ for the root domain. For subdomains, enter just the prefix — Namecheap appends your domain automatically.
- How long until the record is live?
- The default "Automatic" TTL (30 minutes) is fine; changes are typically live within 30 minutes. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- What value do I put in a CAA record?
- Each CA publishes its own CAA identifier: letsencrypt.org for Let's Encrypt, digicert.com for DigiCert (all brands), sectigo.com for Sectigo/ZeroSSL, pki.goog for Google Trust Services, and amazon.com for AWS Certificate Manager. The record format is: 0 issue "identifier".