← Guides

Set Up CAA Records: Step-by-Step DNS Guide

2026-10-13 · 5 min read

Step 1 — Find where your DNS lives

Your CAA records go wherever your domain's nameservers point: Cloudflare, your registrar's DNS, Route 53, etc. Log in there.

Step 2 — Add the records

Add three records of type CAA (replace example.com and the CA name):

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild ";"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

Step 3 — Wait for propagation

DNS changes take up to your TTL to propagate (often under an hour). Don't panic if the check below is empty immediately.

Step 4 — Verify

Run dig CAA example.com +short — you should see your three records. Or run DomainGuard's free report, which checks CAA posture automatically.

Step 5 — Keep monitoring

CAA is a policy, not a lock — keep watching CT logs for what actually gets issued. DomainGuard Pro does this continuously from $29/mo.