CAA Records

CAA records list the certificate authorities allowed to issue certificates for your domain. Most domains have none. If yours has none, any authority can issue, and you don’t need to do anything.

If your domain has CAA records

Add one record that allows the authority Expedited SSL uses:

example.com.  CAA  0 issue "sectigo.com"

Keep your existing CAA records. This adds one alongside them.

If you use SSL Wildcard or Private Space Wildcard and your domain has issuewild records, add the same value as an issuewild record too:

example.com.  CAA  0 issuewild "sectigo.com"

Where to add it

A CAA check starts at the name on the certificate and moves up to its parent domains. The first name that has CAA records decides. Add the record next to your existing CAA records, which is usually your root domain (example.com).

How you’ll know

When a CAA record blocks your certificate, your setup page says so and we email you. We don’t issue until the record allows it. Once you add the record, we pick it up on our next check and issue your certificate.