@ for the root of the domain, or the subdomain on its own (shop for shop.example.com).0.issue for normal certificates. Use issuewild only if you want wildcards handled differently, and iodef for a reporting address.letsencrypt.org. Leave out the quotes.To allow more than one CA, use Add More Records before saving, or repeat the steps. Each CA gets its own record.
If you have Domain Protection turned on, GoDaddy may ask you to confirm the change with a code before it saves.
Use the identifier of whichever CA issues your certificates. Some common ones, and there are more in the full list:
| Certificates from | Domain value |
|---|---|
| GoDaddy SSL | godaddy.com |
| Let's Encrypt | letsencrypt.org |
| Sectigo, including ZeroSSL | sectigo.com |
| DigiCert | digicert.com |
| Google Trust Services | pki.goog |
Check with your web host too. If they set up certificates for you, they'll be using a CA of their own, and it needs a record or their renewals will fail.
Leave the flag on 0. The 128 option is for less common tags you have to type in yourself, and with it set a CA that doesn't recognise the tag has to refuse every request. A typo with flag 128 blocks all certificates for the domain.
GoDaddy's form has an optional parameters field for things like accounturi and validationmethods. Most people don't need them. If you do, the Let's Encrypt guide explains what they do.
GoDaddy says most DNS changes take effect within an hour, although it can take longer. Test the domain below, or run:
dig CAA example.com +short