A CAA (Certification Authority Authorization) record is a DNS record that sets which certificate authorities may issue SSL certificates for your domain. An authority that is not listed cannot issue a certificate in your name.
Careful
- If you add a CAA record, list every authority you use; otherwise your certificate cannot renew.
- At webevi you need
letsencrypt.orgfor Let's Encrypt andsectigo.comfor Comodo/Sectigo.
Benefits
- Blocks unauthorised certificates: Only the authorities you allow can issue certificates.
- Reduces the risk of fake sites: Makes it harder for attackers to get a certificate for your domain.
- Helps in audits: Some security scans check for a CAA record.
- Separate rule for wildcards: With the
issuewildtag you can restrict wildcard certificates separately.
Adding a CAA record in Plesk
- Log in to your Plesk panel at
https://yourdomain.com:8443or from the service page in your client area. - On the Websites & Domains page, click DNS on your domain's Hosting & DNS tab.
- Click Add Record and choose CAA as the record type.
- Set the flag to
0, the tag toissueand the value toletsencrypt.org, then click OK.
- If you use another authority, add a separate record for it and click Update in the notice at the top.
Tags
| Tag | Meaning |
|---|---|
| issue | This authority may issue normal certificates. |
| issuewild | This authority may issue wildcard certificates. |
| iodef | Unauthorised certificate requests are reported to this email or address. |
Need help? Open a support ticket from your client area or call +90 216 348 35 03.
