How to add a CAA record on Squarespace
CAA (Certification Authority Authorization) records name the certificate authorities allowed to issue TLS certificates for your domain. Without CAA, any CA in the world may issue for it; with CAA, issuance is scoped to the CAs you actually use.
The critical rule: every CA that issues certificates for your domain — including ones renewing automatically behind a CDN or load balancer — must be listed, or their next renewal will fail. CAs are required to check CAA before issuing.
The record you'll add
TypeCAA
Name@@ means the root of your domain.
Value0 issue "letsencrypt.org"This example authorizes Let's Encrypt. Use the identifier documented by the CA that issues YOUR certificates — the SSL checker below reads your current certificate and generates the matching CAA record.
TTLThe default 4-hour TTL works; Squarespace says record changes can take 24–48 hours to fully propagate.
Steps on Squarespace
- Open your Squarespace Domains dashboard and select the domain.
- Go to DNS → DNS Settings and scroll to Custom Records.
- Click Add record and choose the record type.
- Enter @ (root) or the prefix shown above — Squarespace appends your domain automatically — paste the Value, and save.
Squarespace quirks worth knowing
- ⚠If this domain migrated from Google Domains and still shows legacy "Google Domains DNS", its records are frozen — switch the domain to Squarespace DNS first, then add records.
Provider steps verified against Squarespace: Adding custom DNS records on 2026-07-12.
Get the exact record for your domain
The free SSL checker reads your domain's live DNS, flags what's wrong, and generates the precise CAA record to publish — then rechecks to confirm the fix took.
Run the SSL checker →Frequently asked questions
- What goes in the Name field on Squarespace?
- Enter @ for the root domain. For subdomains, enter just the prefix — Squarespace appends your domain automatically.
- How long until the record is live?
- The default 4-hour TTL works; Squarespace says record changes can take 24–48 hours to fully propagate. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- What value do I put in a CAA record?
- Each CA publishes its own CAA identifier: letsencrypt.org for Let's Encrypt, digicert.com for DigiCert (all brands), sectigo.com for Sectigo/ZeroSSL, pki.goog for Google Trust Services, and amazon.com for AWS Certificate Manager. The record format is: 0 issue "identifier".