Each CA looks for its own identifier in your CAA records, and it's not always the same as the CA's website. Add an issue record for every CA that issues certificates for your domain, including any your host, CDN or other services use on your behalf.
| CA | Value |
|---|---|
| Let's Encrypt | letsencrypt.org |
| Google Trust Services | pki.goog |
| Amazon (ACM) | amazon.com |
| Sectigo and ZeroSSL | sectigo.com |
| DigiCert, GeoTrust, RapidSSL, Thawte | digicert.com |
| GlobalSign and AlphaSSL | globalsign.com |
| SSL.com | ssl.com |
| GoDaddy | godaddy.com |
CAs occasionally change or add identifiers. If a CA refuses a request and its value is already in your records, check its own documentation.
CAA 0 issue "letsencrypt.org"
Let's Encrypt also supports locking issuance to your ACME account and to one validation method. The Let's Encrypt guide covers both, along with its error messages.
CAA 0 issue "pki.goog"
Google's own CA. You may need it even if you've never bought from Google: Cloudflare uses it for some of its edge certificates, and Webflow uses it alongside Let's Encrypt. Google also offers free ACME certificates, which work with Certbot and other ACME clients.
CAA 0 issue "amazon.com"
ACM also accepts amazontrust.com, awstrust.com and amazonaws.com, but one is enough. CloudFront, load balancers and API Gateway usually get their certificates from ACM, so this one is easy to forget. The Route 53 guide has more on AWS.
CAA 0 issue "sectigo.com"
ZeroSSL certificates are issued by Sectigo, so ZeroSSL needs sectigo.com too. There's no separate ZeroSSL value. The same goes for certificates resold under other names that come from Sectigo, and for Sectigo's older Comodo branding.
CAA 0 issue "digicert.com"
DigiCert took over Symantec's certificate business, and a single digicert.com record covers all of its brands. You'll still find older guides suggesting symantec.com or a separate value per brand. Use digicert.com.
CAA 0 issue "globalsign.com"
This covers GlobalSign's own certificates and its AlphaSSL range.
CAA 0 issue "ssl.com"
Cloudflare also uses SSL.com for some edge certificates, so it's one of the records Cloudflare adds for you. See the Cloudflare guide.
CAA 0 issue "godaddy.com"
For certificates bought from GoDaddy. If GoDaddy only runs your DNS and the certificate comes from elsewhere, use that CA's value instead. The GoDaddy guide shows where to add it.
Some platforms switch between CAs, so you need to allow all of them or renewals can fail without warning:
letsencrypt.org and pki.goog.For wildcards, the same values go in issuewild records, but only if you have issuewild records at all. How issue and issuewild work.