CAA records on Wix: what to know
CAA (Certification Authority Authorization) records name the certificate authorities allowed to issue TLS certificates for your domain. Without CAA, any CA in the world may issue for it; with CAA, issuance is scoped to the CAs you actually use.
The critical rule: every CA that issues certificates for your domain — including ones renewing automatically behind a CDN or load balancer — must be listed, or their next renewal will fail. CAs are required to check CAA before issuing.
WixDNS doesn't support CAA records
Wix DNS does not support CAA records at all. To use CAA you'd have to host your DNS elsewhere and point it at Wix.
Practically, that leaves two options: keep DNS at Wix and accept that any CA may issue for your domain, or move DNS to a provider with CAA support and point it at Wix. Skipping CAA is not a security hole by itself — it just means you don't get CAA's extra guardrail.
Get the exact record for your domain
The free SSL checker reads your domain's live DNS, flags what's wrong, and generates the precise CAA record to publish — then rechecks to confirm the fix took.
Run the SSL checker →Frequently asked questions
- What goes in the Host Name field on Wix?
- Leave it blank for the root domain — Wix fills in your domain automatically.
- How long until the record is live?
- Leave the TTL at Wix's default. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- What value do I put in a CAA record?
- Each CA publishes its own CAA identifier: letsencrypt.org for Let's Encrypt, digicert.com for DigiCert (all brands), sectigo.com for Sectigo/ZeroSSL, pki.goog for Google Trust Services, and amazon.com for AWS Certificate Manager. The record format is: 0 issue "identifier".