How to add a CAA record on Amazon Route 53
CAA (Certification Authority Authorization) records name the certificate authorities allowed to issue TLS certificates for your domain. Without CAA, any CA in the world may issue for it; with CAA, issuance is scoped to the CAs you actually use.
The critical rule: every CA that issues certificates for your domain — including ones renewing automatically behind a CDN or load balancer — must be listed, or their next renewal will fail. CAs are required to check CAA before issuing.
The record you'll add
TypeCAA
Record nameleave blankAmazon Route 53 fills in your domain for the root.
Value0 issue "letsencrypt.org"This example authorizes Let's Encrypt. Use the identifier documented by the CA that issues YOUR certificates — the SSL checker below reads your current certificate and generates the matching CAA record.
TTL300 seconds is a good value; Route 53 changes reach its nameservers within about 60 seconds.
Steps on Amazon Route 53
- Open the Route 53 console (console.aws.amazon.com/route53/) and go to Hosted zones.
- Select your domain's hosted zone and click Create record.
- Leave Record name blank for the root domain, or enter just the prefix (like _dmarc).
- Pick the record type, paste the value — TXT values wrapped in double quotes — and create the record.
Amazon Route 53 quirks worth knowing
- ⚠TXT values must be enclosed in double quotes: "v=spf1 …". Values longer than 255 characters are split into multiple quoted strings on one line.
- ⚠Route 53 still offers a legacy record type named SPF — don't use it; AWS itself recommends TXT only.
- ⚠Route 53 takes the whole CAA value in one field, exactly as shown above: 0 issue "letsencrypt.org" — keep the quotes around the CA identifier.
Provider steps verified against AWS: Creating records in Route 53 on 2026-07-12.
Get the exact record for your domain
The free SSL checker reads your domain's live DNS, flags what's wrong, and generates the precise CAA record to publish — then rechecks to confirm the fix took.
Run the SSL checker →Frequently asked questions
- What goes in the Record name field on Amazon Route 53?
- Leave it blank for the root domain — Amazon Route 53 fills in your domain automatically.
- How long until the record is live?
- 300 seconds is a good value; Route 53 changes reach its nameservers within about 60 seconds. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- What value do I put in a CAA record?
- Each CA publishes its own CAA identifier: letsencrypt.org for Let's Encrypt, digicert.com for DigiCert (all brands), sectigo.com for Sectigo/ZeroSSL, pki.goog for Google Trust Services, and amazon.com for AWS Certificate Manager. The record format is: 0 issue "identifier".