What happens if I forget to add a CAA record for Heroku ACM?

If you do not have any CAA records configured, public CAs operate under an "allow all" policy, meaning Heroku ACM will issue and renew certificates without issue. CAA records are strictly optional for security hardening, not mandatory for functionality.

Does Heroku require a specific CAA flag value?

No, Heroku does not mandate a specific flag value. A flag of 0 is standard and non-critical, which is recommended to prevent accidental issuance failures if a CA encounters an unfamiliar parameter.

Can I use multiple CAs with Heroku custom domains?

Yes. If you use multiple CAs or transition between Heroku ACM and a manual third-party SSL provider, you can add multiple CAA records for both `letsencrypt.org` and your other provider's authorized domain string.

Why is my Heroku ACM failing after adding a CAA record?

ACM failure after adding a CAA record usually means you restricted issuance to a CA other than Let's Encrypt, or you included a typo in the domain value string. Double-check that `letsencrypt.org` is explicitly listed under both `issue` and `issuewild` tags.

Do I need CAA records for every subdomain pointing to Heroku?

No. Because CAA records inherit down the DNS tree, placing the record on your root domain (e.g., `example.com`) automatically covers all subdomains like `www.example.com` unless a subdomain defines its own overriding record.

Heroku CAA Record Setup: Complete DNS Guide

Setting up a CAA (Certification Authority Authorization) record for your Heroku custom domain is essential for controlling which Certificate Authorities are allowed to issue SSL certificates for your website. Without a proper CAA record, any public CA can technically issue a certificate for your domain if they validate control over it, leaving a window open for unauthorized or misissued certificates. This guide walks you through the exact process of identifying your certificate issuer, configuring your DNS provider, and verifying your setup.

Before modifying your production DNS settings, you should check your current authorization state using the CAA Lookup tool on XiaTools to see existing records and identify potential validation gaps instantly.

Understanding CAA Records and Heroku

Heroku manages SSL certificates for custom domains primarily through automated integrations like Automated Certificate Management (ACM), which relies on Let's Encrypt, or through manual endpoint uploads. When you point a custom domain (www.example.com) to Heroku via a CNAME record, you must ensure that your DNS settings explicitly authorize the specific Certificate Authorities (CAs) that Heroku uses.

If your domain lacks a CAA record, CAs assume an "allow all" policy. If you implement a restrictive CAA record without including Heroku's automated issuing CA, your ACM provisioning will fail, resulting in insecure connection errors for your visitors.

How CAA Records Work

A CAA record consists of three main components: flags, tags, and values.

Flags: Usually set to 0 (non-critical) or 1 (critical). If set to 1 and a CA does not understand a specific property tag, it must refuse to issue the certificate.
Tags: Define the control parameter. The most common tags are issue (authorizes a specific CA to issue single/wildcard certificates), issuewild (authorizes a specific CA exclusively for wildcard certificates), and iodef (specifies a URL or email for the CA to report policy violations).
Values: The domain name of the authorized CA (e.g., letsencrypt.org or comodoca.com).

Step-by-Step Heroku CAA Record Setup

Follow these steps to configure your DNS provider correctly for a Heroku custom domain using Automated Certificate Management (ACM).

Step 1: Identify Your CA

Heroku ACM uses Let's Encrypt as its default certificate provider. If you are using ACM, your CAA record must explicitly authorize Let's Encrypt. If you are using a custom manual SNI endpoint or terminating SSL via Cloudflare proxy before Heroku, your required CAs will differ.

Step 2: Access Your DNS Provider

Log in to the DNS hosting provider where your root domain (e.g., example.com) is managed, such as Cloudflare, AWS Route 53, GoDaddy, or Namecheap. Navigate to the DNS management or zone editor section. Note that provider menu paths vary; look for terms like "DNS Records," "Zone Editor," or "Manage DNS."

Step 3: Create the CAA Records

To ensure uninterrupted renewals for Heroku ACM, you need to create records for Let's Encrypt. You should also include your own organization or backup CAs if applicable.

Create the following records in your DNS manager:

Type	Host / Name	Flags	Tag	Value
CAA	`@` or `example.com`	`0`	`issue`	`letsencrypt.org`
CAA	`@` or `example.com`	`0`	`issuewild`	`letsencrypt.org`
CAA	`@` or `example.com`	`0`	`iodef`	`mailto:security@example.com`

Note: Replace example.com with your actual root domain. Many DNS providers automatically prepend the root domain if you leave the host field blank or input @.

Step 4: Verify Record Propagation

Once added, DNS records take time to propagate globally depending on your provider's TTL (Time to Live) settings. You can verify your records from your terminal using standard lookup utilities.

Run the following command in your terminal to check the CAA records for your domain:

dig example.com CAA +short

Expected output sample:

0 issue "letsencrypt.org"
0 issuewild "letsencrypt.org"
0 iodef "mailto:security@example.com"

If you prefer using PowerShell on Windows, run:

Resolve-DnsName -Name example.com -Type CAA

Special Considerations for Heroku Subdomains

CAA records are hierarchical. A CA checking for authorization on www.example.com will first look for CAA records on www.example.com. If none are found, it checks example.com.

Because Heroku custom domains often involve subdomains like www.example.com or app.example.com, you generally only need to place the CAA record on your root zone (example.com). The CAs will inherit these rules for all subdomains unless a specific subdomain overrides them.

Common Mistakes and How to Fix Them

Forgetting Wildcard Authorization: Setting an issue tag does not automatically authorize wildcard certificates. If your Heroku app uses a wildcard domain (e.g., *.example.com), you must include a separate issuewild tag or a combined record.
Syntax Typos in CA Domain Strings: Entering letsencrypt.com instead of letsencrypt.org will cause validation to fail silently during Heroku ACM renewal cycles.
Conflicting Critical Flags: Setting the flag to 1 without understanding your CA's parsing behavior can cause legitimate certificate issuances to be rejected.
Placing Records on CNAME Targets: Do not attempt to place CAA records on Heroku's routing target domains (e.g., herokudns.com). CAA records must live on your own custom domain's DNS zone.

Quick Configuration Checklist

Identified the certificate authority used by your Heroku setup (e.g., Let's Encrypt for ACM).
Logged into your primary DNS provider account.
Added the issue CAA record pointing to the correct CA domain.
Added the issuewild CAA record if utilizing wildcard custom domains on Heroku.
Verified propagation using command-line tools or online lookup utilities.

Configuring CAA DNS Entries in Heroku Custom Domains