A CAA record is a DNS record that says which certificate authorities can issue TLS certificates for your domain. How CAA records work
Enter a domain or subdomain to see the CAA records that apply to it. It's checked the same way a CA checks it: if the name has no records of its own the parent domains are tried, CNAMEs are followed, and DNS failures that would stop a certificate being issued are reported.
Getting a "CAA record prevents issuance" error? Start here.
✘ No CAA record found
Any certificate authority can issue certificates for gratipay.com. Add a record to restrict it, for example:
CAA 0 issue "letsencrypt.org"
How CAA records work
How to add a CAA record: Cloudflare · GoDaddy · AWS Route 53 · values for each CA