A CAA (Certification Authority Authorization) record specifies which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. This guide walks you through adding a CAA record in Plesk.

### What is a CAA record?

A CAA record tells certificate authorities: "only the CAs listed here may issue certificates for this domain." If an unlisted CA receives a request, they must refuse it. CAA records are inherited by subdomains unless overridden.

Each CAA record has three parts:

- **Flag** — usually `0`
- **Tag** — `issue` (standard certs), `issuewild` (wildcard certs), or `iodef` (violation reports)
- **Value** — the CA identifier (e.g. `letsencrypt.org`, `sectigo.com`, `digicert.com`)

### Adding a CAA record in Plesk

1. Log in to Plesk.
2. Go to **Websites & Domains** → find your domain.
3. Click **Hosting & DNS** → **DNS Settings**.
4. Click **Add Record**.
5. Select **CAA** as the record type.
6. Fill in the fields:
   - **Domain name** — leave blank for the root domain
   - **Flag** — enter `0`
   - **Tag** — select `issue`, `issuewild`, or `iodef`
   - **Value** — enter the CA identifier (e.g. `letsencrypt.org`)
7. Click **OK** to save.
8. If prompted, click **Update** to apply DNS changes.

### Verifying your CAA record

Run `dig yourdomain.com CAA` or use an online tool like **DNSChecker.org**. Propagation can take up to 48 hours.

### Important notes

- If you have **no** CAA records, any CA can issue certificates — this is fine for most sites.
- If you **do** add CAA records, include every CA you use — forgetting one blocks renewals.
- If you use **Let's Encrypt** via Plesk auto-SSL, always include `letsencrypt.org`.
- CAA records don't affect existing certificates — only new issuance and renewals.

### Troubleshooting

**SSL issuance/renewal fails after adding CAA records:**

- Check your CA is listed. For Let's Encrypt, the value must be `letsencrypt.org`.
- Verify with `dig yourdomain.com CAA`.
- Make sure the tag is correct — `issue` for standard, `issuewild` for wildcard.

**CAA not available in the dropdown:**

- You need **Plesk Obsidian 18.0** or later. Contact your hosting provider if unavailable.

**Record not showing in lookups:**

- Wait for propagation and ensure you clicked **Update** in Plesk.
- If using external DNS (e.g. Cloudflare), add the record there instead.

Need help? [Contact our support team](https://www.allanuxweb.com/submitticket.php).

### Related Guides

- [Add an SRV record](/hc/help/en/articles/how-to-add-an-srv-record-in-plesk)
- [Manage DNS records](/hc/help/en/articles/how-to-manage-dns-records-in-plesk)
- [Set up DNSSEC](/hc/help/en/articles/how-to-set-up-dnssec-for-your-domain-in-plesk)