Configure CAA Records in Namecheap DNS to Restrict SSL Issuance

Unless you explicitly block them, any trusted Certificate Authority (CA) on earth can sign a valid SSL certificate for your domain. If a rogue or misconfigured CA halfway around the world decides to issue a cert for your site, browsers will trust it without batting an eye. Adding DNS Certification Authority Authorization (CAA) records inside Namecheap Advanced DNS stops this by locking issuance down to only the providers you actually use.

It takes five minutes to configure, but Namecheap has a few UI quirks that can silently break your automated certificate renewals if you aren’t careful.

What CAA Records Actually Stop (and What They Don’t)

A CAA record is a DNS resource record standardized in RFC 8659. It tells public CAs which entities hold signing rights for your domain. Since late 2017, the CA/Browser Forum has mandated that every compliant CA must query DNS for CAA records before issuing a certificate.

If an attacker tricks an automated validation endpoint or compromises a low-tier CA, that CA still has to check your DNS first. If your CAA records only permit Let’s Encrypt or Sectigo, the CA has to abort the request immediately.

Here is what CAA records handle:

• Unauthorized CAs: Stops shadow IT, rogue developers, or compromised external authorities from minting certificates for your domain through providers you never vetted.
• Wildcard misissuance: Gives you granular control over wildcard certs (like *.example.com) separately from standard single-domain certs.
• Violation alerts: Sends automated problem reports straight to your inbox if someone attempts an unauthorized issuance.

What they don’t do: CAA won’t protect you if an attacker has already compromised your DNS records, hijacked your ACME HTTP validation route, or stolen your server API keys. If an attacker can prove domain control to your allowed CA, that CA will still issue the cert. CAA restricts the authorities, not the identity checks those authorities run.

Anatomy of a CAA Record: Tags, Flags, and Values

A standard CAA record consists of three parts: a flag, a tag, and a value. In a standard zone file, they look like this:

example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"

Here is how those fields work before we translate them into Namecheap’s web console:

• Flag (0 or 128): An 8-bit integer. Almost everyone uses 0 (non-critical). Setting this to 128 (critical) instructs the CA that if it does not recognize your specific tag, it must immediately abort issuance. Unless you have an enterprise compliance requirement, stick to 0.
• issue: Grants a specific CA permission to issue standard, multi-domain, and wildcard certs (unless overridden by issuewild).
• issuewild: Specifically governs wildcard certificates. Setting issuewild ";" shuts down wildcard issuance entirely across the entire domain.
• iodef: Incident Object Description Exchange Format. Accepts a mailto: link or https:// URL where CAs can shoot incident payloads whenever an issuance attempt violates your policy.

Planning Your Certificate Authority Policy

Before editing DNS records, take an inventory of every single provider terminating TLS on your domain. If you miss one, your next automated renewal will bomb out in the middle of the night and take your site down with expired cert warnings.

Here are the canonical domain strings for common providers:

• Let’s Encrypt: letsencrypt.org (used by Certbot, Traefik, cPanel, Nginx). Check the Let’s Encrypt CAA guide for their specific implementation notes.
• DigiCert: digicert.com
• Sectigo / Comodo: sectigo.com (used for Namecheap’s own paid PositiveSSL certificates)
• Amazon Web Services: amazon.com (AWS Certificate Manager, CloudFront, ALB)
• Google Trust Services: pki.goog (standard for GCP and modern Google-managed environments)
• Cloudflare: Cloudflare often rotates between DigiCert, Let’s Encrypt, Sectigo, and Google Trust Services depending on your plan tier.

If your stack relies on wildcard subdomains with Certbot DNS challenge and Nginx, you must make sure Let’s Encrypt has permission to issue wildcards, not just apex certs.

Step-by-Step: Adding CAA Records in Namecheap Advanced DNS

Namecheap supports CAA records directly under BasicDNS and PremiumDNS. If you are delegating to external nameservers (like Cloudflare, Route 53, or self-hosted servers), you need to add your CAA records there instead. If you manage custom nameservers, check out our guide to register custom nameservers with glue records on Namecheap.

If you’re using Namecheap’s DNS manager, here is how to configure them:

1. Log in to your Namecheap dashboard.
2. Head to Domain List, find your domain, and click Manage.
3. Open the Advanced DNS tab.
4. Scroll down to Host Records and click Add New Record.
5. Pick CAA Record from the dropdown.

Namecheap breaks this record into several form inputs:

• Type: CAA Record
• Host: @ (for apex domain) or a subdomain prefix like api
• Value: Contains three sub-fields: Flag, Tag, and CA Target.
• TTL: Automatic or 30 min

Here is what your inputs should look like for standard production setups:

# Scenario 1: Only Let's Encrypt allowed (both standard and wildcard) Namecheap UI fields:
Type: CAA Record
Host: @
Flag: 0
Tag: issue
Target Value: letsencrypt.org
TTL: Automatic # Scenario 2: Let's Encrypt for standard, Amazon for wildcards
Record 1:
Host: @ | Flag: 0 | Tag: issue | Target: letsencrypt.org
Record 2:
Host: @ | Flag: 0 | Tag: issuewild | Target: amazon.com

Click the green checkmark to save each record. If you are also doing apex forwarding or host routing, read our guide on how to point a Namecheap apex domain to a hostname target using ALIAS records to make sure your host values don’t create conflicts.

Handling Wildcard Certificates and Subdomains

The interaction between issue and issuewild trips people up regularly. DNS zone inheritance follows a strict hierarchy here.

If you only configure an issue tag, that CA can sign both regular single-name certs and wildcard certs:

# This allows letsencrypt.org to issue both app.domain.com AND *.domain.com
Type: CAA Record
Host: @
Flag: 0
Tag: issue
Target Value: letsencrypt.org

The moment you add a single issuewild record to your zone, standard issue records no longer apply to wildcard requests. The issuewild directive completely takes over wildcard policy.

For instance, if your internal security policy forbids wildcard certificates, you can shut down wildcard issuance globally by supplying a lone semicolon:

Type: CAA Record
Host: @
Flag: 0
Tag: issuewild
Target Value: ;
TTL: Automatic

The semicolon acts as an empty CA set. Even though you authorized Let’s Encrypt for root certificates with issue, the presence of issuewild ; tells Let’s Encrypt to flat-out reject any request for *.example.com.

Subdomains inherit CAA records from their parent domain by default. If api.example.com has no CAA records of its own, the CA will look up the tree to example.com. But if api.example.com defines its own CAA record, it overrides the parent record completely for that specific subdomain.

Setting Up iodef Incident Reporting

The iodef tag turns your CAA record into an early warning system. If a rogue actor or broken script tries to order a certificate from an unauthorized CA, that CA will ping your reporting address.

Configure it using standard email URI syntax:

Type: CAA Record
Host: @
Flag: 0
Tag: iodef
Target Value: mailto:certs-alerts@example.com
TTL: Automatic

Make sure this inbox can actually receive messages from automated external mailers. If your MX routing passes through Namecheap, double-check that you’ve correctly configured SPF, DKIM, and DMARC in Namecheap DNS so inbound security telemetry isn’t dropped by your spam filters.

When an unauthorized request triggers a violation, CAs that implement IODEF will send an automated XML or JSON report including:

• The exact domain name requested
• The requesting IP and validation method used
• The timestamp of the rejected request
• The CAA policy entries that caused the rejection

Testing and Verifying CAA Propagation with dig and drill

Don’t immediately try to run an SSL issuance script right after saving records in Namecheap. Give Namecheap’s edge 5 to 15 minutes to sync, and query the records directly from your terminal first.

Query Google’s public resolver for your domain’s CAA records using dig:

dig +noall +answer CAA example.com

You should see your flags and tags returned in the ANSWER section:

example.com. 1799 IN CAA 0 issue "letsencrypt.org"
example.com. 1799 IN CAA 0 issuewild ";"
example.com. 1799 IN CAA 0 iodef "mailto:certs-alerts@example.com"

If you suspect local DNS caching is feeding you stale results, query Namecheap’s authoritative nameservers directly:

# Find authoritative nameservers
dig +short NS example.com # Query the primary Namecheap nameserver directly
dig @dns1.registrar-servers.com CAA example.com +short

Once dig confirms the records exist, you can run your site through the Qualys SSL Labs test to verify that external analyzers recognize your CAA directives.

What I Broke: Debugging Let’s Encrypt CAA Rejections

I hit an infuriating bug a while back while setting up automated Let’s Encrypt renewals with Certbot. Out of nowhere, the renewal hook failed with this error:

certbot.errors.AuthorizationError: urn:ietf:params:acme:error:caa :: CAA record does not permit issuance for dev.example.com

I checked Namecheap. I had an issue record configured for letsencrypt.org at the root @, and running dig CAA dev.example.com showed no overrides. The renewal should have crawled up the tree, matched Let’s Encrypt, and succeeded.

Here’s what actually happened:

1. In Namecheap’s web panel, I typed the CA Target with quotes, entering "letsencrypt.org".
2. Namecheap’s backend automatically wraps CAA target values in quotes when it compiles the zone file behind the scenes.
3. Because I added quotes in the UI, the compiled DNS record resolved as ""letsencrypt.org"".
4. Let’s Encrypt read the target string literally as "letsencrypt.org" (with embedded quotation marks), failed to match its own canonical name, and blocked the certificate.

The fix in Namecheap is simple: do not include quotation marks in the Target Value field. Just write the raw domain name:

# Correct in Namecheap UI:
Target: letsencrypt.org # Incorrect (will cause validation failures):
Target: "letsencrypt.org"

Once I stripped the extra quotes and waited ten minutes for the TTL to expire, Certbot cleared validation on the next attempt.

Frequently Asked Questions

Do CAA records break existing SSL certificates?

No. CAs evaluate CAA records only when generating, re-issuing, or renewing a certificate. Any active, installed cert on your server will keep working unaffected until its normal expiration date.

Can I authorize more than one Certificate Authority?

Yes. Add multiple CAA records with the issue tag. For example, add one record with letsencrypt.org and another with sectigo.com. Both CAs will be authorized to validate and sign certificates for your domain.

What happens if I make a typo in the CA domain?

If you misspell the target (like letsencryp.org), no real CA will match your rule. When your ACME client or automated renewal kicks off, the CA will read your DNS, see that its actual domain name isn’t listed, and immediately fail the issuance.

Are CAA records mandatory for my website to work?

No. If your domain has no CAA records at all, every valid CA on the internet has permission to issue certificates for it. Adding CAA records is strictly a defense-in-depth security measure to prevent unauthorized cert issuance.

Next Steps for DNS Hardening

CAA records are a major security upgrade, but they rely entirely on the integrity of your DNS responses. If an attacker manages to compromise your DNS provider or poison resolver caches, they can easily bypass your policy.

To seal this gap, turn on DNSSEC (Domain Name System Security Extensions) in Namecheap. DNSSEC cryptographically signs your zone records, ensuring CAs and resolvers can verify that your CAA records haven’t been tampered with or stripped out in transit.