CAA records for Let's Encrypt

The record you need

CAA 0 issue "letsencrypt.org"

letsencrypt.org is the identifier Let's Encrypt checks for. Put it on the domain you're getting certificates for, or on its parent, since subdomains with no CAA records of their own use the parent's.

In a DNS control panel that's flag 0, tag issue, value letsencrypt.org, with the name set to @ (or left blank) for the root of the domain.

If you get certificates from anywhere else as well, such as a CDN or your hosting provider, add an issue record for that CA too (values for each CA). Leave one out and its renewals will start failing.

Wildcard certificates

The record above covers wildcards too, as long as the domain has no issuewild records. If it does have some, wildcards only follow those, so Let's Encrypt needs one of its own:

CAA 0 issue "letsencrypt.org"
CAA 0 issuewild "letsencrypt.org"

You only need issuewild at all if you want wildcards handled differently from normal certificates, for example allowing them from one CA but not another.

Locking it to your account

A plain letsencrypt.org record lets anyone get a Let's Encrypt certificate for your domain, as long as they can pass validation. You can narrow that to your own ACME account with accounturi:

CAA 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890"

The number at the end is your account ID. With Certbot you can find the full URL by running:

certbot show_account

Other ACME clients keep it with the account details they store, so check their docs.

Some things to watch for:

• Every server or client that gets certificates for the domain needs its account listed. Add one record per account. Records are combined, so any of them can issue.
• Moving to a new server or reinstalling your client often registers a new account, which won't match. Copy the old account across or update the record first.
• The staging environment uses separate accounts, with URLs starting https://acme-staging-v02.api.letsencrypt.org/acme/acct/. If you test against staging, add that account too.
• On Cloudflare with Universal SSL, Cloudflare adds its own plain issue "letsencrypt.org" record that you can't see in the dashboard. That lets any Let's Encrypt account issue again. See the Cloudflare guide.

Restricting the validation method

You can also limit which challenge Let's Encrypt will accept. The options are http-01, dns-01 and tls-alpn-01:

CAA 0 issue "letsencrypt.org; validationmethods=dns-01"

Both parameters can go in the same record:

CAA 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890; validationmethods=dns-01"

Make sure your client is actually set up for the method you allow. A client using HTTP validation will be refused by a record that only allows dns-01.

Let's Encrypt CAA errors

CAA record for example.com prevents issuance

Let's Encrypt found CAA records and they don't allow it. Usually letsencrypt.org is missing, wildcards are blocked by an issuewild record, or an accounturi or validationmethods parameter doesn't match. Test the exact name on the certificate to see which records apply, as they may be on a parent domain or the target of a CNAME.

DNS problem: SERVFAIL looking up CAA for example.com

Let's Encrypt couldn't get an answer at all, so it won't issue. Most often this is a DNSSEC problem. It can also be nameservers that don't support CAA queries and return an error, or a firewall that drops them so the lookup times out.

The troubleshooting guide goes through each of these in more detail.