Configuring Domain CAA Policies for ZeroSSL Certificate Issuance

To complete a zerossl caa record setup, you must publish a DNS Certification Authority Authorization (CAA) record that explicitly grants ZeroSSL permission to issue SSL/TLS certificates for your domain. Without this record, your domain might still obtain certificates if you haven't restricted issuance, but configuring CAA hardens your security posture against unauthorized certificate generation. This comprehensive guide walks you through the exact syntax, DNS provider steps, verification methods, and troubleshooting techniques required for a flawless configuration.

Understanding CAA Records for ZeroSSL

A CAA record is a type of Domain Name System (DNS) resource record that allows domain owners to declare which Certificate Authorities (CAs) are authorized to issue certificates for their domain. When ZeroSSL receives a request to issue a certificate for example.com, its automated validation systems query your domain's DNS for CAA records. If authorized, issuance proceeds; if a different CA is explicitly allowed and ZeroSSL is omitted, issuance is blocked.

ZeroSSL utilizes Sectigo's infrastructure for certificate issuance and validation. Therefore, your CAA records must authorize both sectigo.com and potentially zerossl.com depending on the validation path and current system integrations. Let's examine the exact syntax required for your DNS zone.

Exact Record Syntax

A standard CAA record consists of three primary components: flags, tags, and values. For ZeroSSL and Sectigo, you need to configure the issue tag (for single-domain and wildcard certificates) and the issuewild tag (if you specifically restrict wildcards differently).

Here is the exact record structure you need to add to your DNS zone:

example.com.   IN   CAA   0 issue "sectigo.com"
example.com.   IN   CAA   0 issuewild "sectigo.com"

In some environments, you may also need to include comodo.com or zerossl.com depending on legacy API integrations, but sectigo.com is the primary recognized authority string for ZeroSSL infrastructure.

Step-by-Step ZeroSSL CAA Record Setup

Configuring these records involves accessing your DNS hosting provider, creating the resource records, and verifying that global nameservers have propagated your changes correctly.

Step 1: Check Existing DNS Configuration

Before making changes, inspect your existing DNS records to ensure you do not accidentally lock out other legitimate CAs that your organization currently relies on, such as Let's Encrypt or DigiCert.

You can verify your current setup using the CAA Lookup tool on XiaTools, which queries global root servers instantly and presents active issuance policies in an easy-to-read table.

Step 2: Access Your DNS Provider Management Console

Log in to your DNS hosting provider or domain registrar (such as Cloudflare, Route 53, GoDaddy, or Namecheap). Navigate to the DNS management or zone file editor section. Note that exact menu paths vary by provider, but you will generally look for "Manage DNS," "DNS Zone Editor," or "Custom DNS Records."

Step 3: Add the CAA Records

Create a new record with the following parameters:

• Type: CAA
• Name / Host: @ (or leave blank to target the root domain example.com, or enter a subdomain like shop if restricting a specific subdomain)
• Flags: 0 (Critical flag set to 0, meaning standard enforcement. Setting this to 1 means CAs that do not understand the tag must abort issuance)
• Tag: issue
• Value: sectigo.com

Repeat the process for wildcard restrictions if necessary:

• Type: CAA
• Name / Host: @
• Flags: 0
• Tag: issuewild
• Value: sectigo.com

If you also use email signing or specialized reporting, you can add a iodef tag:

• Type: CAA
• Name / Host: @
• Flags: 0
• Tag: iodef
• Value: mailto:security@example.com

Verifying Your Configuration

Once you save your DNS records, propagation can take anywhere from a few seconds to a few hours depending on your TTL (Time to Live) settings. You should verify that the records are publicly visible and correctly formatted using command-line utilities.

Using Dig

Run the following dig command in your terminal to query the CAA records directly:

dig example.com CAA +short

Sample Output:

0 issue "sectigo.com"
0 issuewild "sectigo.com"

Using PowerShell

If you are operating in a Windows Server environment, use PowerShell to query the DNS records:

Resolve-DnsName -Name example.com -Type CAA

Sample Output:

Name             Type   TTL   Section   NameTarget
----             ----   ---   -------   ----------
example.com      CAA    3600  Answer    Flags = 0, Tag = issue, Value = sectigo.com
example.com      CAA    3600  Answer    Flags = 0, Tag = issuewild, Value = sectigo.com

Comparison of CAA Tag Types

Tag Name	Purpose	Example Value	Recommended Usage
issue	Authorizes a CA to issue standard and SAN certificates	sectigo.com	Mandatory for ZeroSSL basic certificates
issuewild	Authorizes a CA to issue wildcard certificates exclusively	sectigo.com	Required if you plan to issue *.example.com
iodef	Specifies an Incident Description Exchange Format URI for policy violations	mailto:admin@example.com	Optional; receives reports of unauthorized issuance attempts

Common Mistakes and How to Fix Them

Even experienced engineers occasionally misconfigure DNS security policies. Watch out for these frequent pitfalls:

• Omitting Wildcard Authorizations: If you configure only the issue tag and attempt to order a wildcard certificate (*.example.com), ZeroSSL will fail issuance. Always include the issuewild tag if you utilize wildcards.
• Typing CA Domain Names: Spelling errors like secitgo.com or missing the quotation marks around the domain value will cause strict CAs to ignore the record or fail validation.
• Setting the Critical Flag Incorrectly: Setting the flag to 1 when testing or when unsure can cause unexpected issuance failures across multiple CAs if your DNS syntax has minor formatting anomalies. Keep the flag at 0 unless you explicitly want to force strict rejection by non-conforming CAs.
• Forgetting Subdomains: CAA records do not automatically inherit down to subdomains unless standard DNS tree-climbing rules apply. If you request a certificate for api.example.com, ZeroSSL checks api.example.com first, then walks up to example.com if no record is found.

Configuration Checklist

Use this quick checklist to ensure your setup is complete and production-ready:

• Identified all legitimate CAs your organization uses (e.g., ZeroSSL/Sectigo, Let's Encrypt).
• Added issue "sectigo.com" to the root DNS zone.
• Added issuewild "sectigo.com" if ordering wildcard certificates.
• Confirmed flag values are set to 0 for standard parsing.
• Verified public visibility using command line tools or online lookups.
• Tested certificate generation inside your ZeroSSL dashboard.