Adding a CAA record in AWS Route 53

Adding the record

• In the AWS console, open Route 53 › Hosted zones and select your domain.
• Select Create record.
• Record name: leave it blank for the root of the domain, or enter the subdomain (shop for shop.example.com).
• Record type: CAA.
• Value: one line per CA, in the full format with the quotes (values for each CA):

0 issue "amazon.com"
0 issue "letsencrypt.org"

• Set a TTL (300 is fine while you're testing) and select Create records.

Two things Route 53 is fussy about

All the CAA records for a name go in one record. Route 53 keeps every CAA value for a name together in a single record, one per line. If there's already a CAA record for that name, edit it and add a line. Trying to create a second one gives an error.

The quotes are required. Route 53 rejects 0 issue amazon.com with an invalid value error. It has to be 0 issue "amazon.com".

Allowing AWS Certificate Manager

ACM accepts any of these, and one is enough:

0 issue "amazon.com"
0 issue "amazontrust.com"
0 issue "awstrust.com"
0 issue "amazonaws.com"

This matters even if you never think about certificates on AWS. CloudFront, load balancers and API Gateway custom domains usually get their certificates from ACM, so as soon as your domain has CAA records, ACM has to be in them or those certificates won't renew.

For wildcard certificates from ACM, the issue record is enough unless the domain also has issuewild records. In that case add 0 issuewild "amazon.com" too.

Subdomains and CNAMEs

A subdomain with no CAA records of its own uses the parent's, so records on the root of the domain cover everything under it. A subdomain's own records replace the parent's completely rather than adding to them.

A name that's a CNAME can't have a CAA record of its own. The lookup follows the CNAME and uses whatever CAA records the target has.

Checking it worked

Route 53 changes usually reach its nameservers within a minute. Test the domain below, or run:

dig CAA example.com +short