Free DNS tool

CAA record lookup

Q: Which value do I use for Let’s Encrypt?

0 issue "letsencrypt.org" . Add issuewild as well if you use wildcard certificates.

CAA records list the certificate authorities that may issue HTTPS certificates for a name. A wrong CAA record is a common cause of failed Let’s Encrypt renewals.

Reading CAA records

0 issue "letsencrypt.org" – Let’s Encrypt may issue normal certificates.
0 issuewild "sectigo.com" – Sectigo may issue wildcard certificates.
0 iodef "mailto:security@example.com" – where CAs report refused requests.

If a name has no CAA records, CAs check its parent names up to the domain. If none have any, every CA may issue.

Fixing “CAA record prevents issuance”

Add an issue record for the CA you actually use, or remove restrictive records you no longer need. Then request the certificate again.

Frequently asked questions

Do I need CAA records?

No, they are optional. They add protection by stopping other CAs from issuing certificates for your domain.

Which value do I use for Let’s Encrypt?

0 issue "letsencrypt.org". Add issuewild as well if you use wildcard certificates.

A name for your next idea

Give your website, home server or next project a memorable address: yourname.uk.app. Choose your name and check availability before registering.

Find your name

CAA record lookup

Reading CAA records

Fixing “CAA record prevents issuance”

Frequently asked questions

More free tools

A name for your next idea

Partners