Choose who may issue certificates for your domain (CAA)

This article is for anyone who wants to control which certificate authorities are allowed to issue certificates for their domain, without accidentally locking out the authority they actually use.

Overview

• A CAA record lists the certificate authorities allowed to issue certificates for your domain — every other authority must refuse the request.
• This keeps anyone from getting a certificate for your name from an authority you never use.
• The risk is leaving out an authority you do use — your next renewal would be refused and the certificate would expire.
• InfraNest builds your CAA setup from what it already knows about your certificates, so this doesn't happen.

Set it up for one domain

1. Open the domain from Domains, or its zone from DNS.
2. In Protection, choose Add next to CAA.
3. Check the preview. It lists the records InfraNest will add and, underneath, every certificate on the domain with whether it stays renewable.
4. Choose Write. InfraNest writes the records through your DNS host and then checks public DNS.

Which authorities InfraNest allows

• The authorities behind your certificates — any that issued a certificate for the domain in the last 13 months, since that's where the next renewal will go.
• The ones you expect — the issuers you listed on the domain page under Expected issuers.
• The network in front of your site — Cloudflare, Fastly or Amazon CloudFront issue their own certificates, so their authorities are allowed too. If your domain's DNS is at Cloudflare, Cloudflare publishes its own CAA records, so InfraNest leaves those alone.

NoteInfraNest only ever adds records. Anything you already have stays exactly as it is — including a value tied to your account, which InfraNest never widens with a plain one.

When InfraNest does not offer it

• A certificate's authority cannot be named. Publishing a first CAA set would stop that certificate from renewing, so InfraNest refuses and tells you which certificate is affected.
• There is nothing to allow yet. A CAA set built from nothing would forbid every authority.
• A record is marked critical with a tag InfraNest does not know. Authorities are already refusing because of it, so that needs fixing first.

When CAA already blocks something

If your CAA records leave out an authority that's in use, the DNS page and the domain page will say so — before the renewal fails.

1. Choose Add to allow exactly the authorities that are missing.
2. A certificate's own page offers the same fix for that one certificate.
3. For a wildcard certificate, this also adds the issuewild record a wildcard needs.

Several domains at once

1. Go to the Domains overview.
2. Check the CAA records line — it counts the domains that already have CAA set up.
3. Choose Add to see, per domain, what InfraNest will write and which domains are skipped and why.

Undo

Every change is recorded in the zone's History as one change, so you can undo it in a single step.

TipIf you're unsure whether a change is safe, check the preview's list of affected certificates first — it shows exactly what stays renewable before you commit to Write.