Review CAA Records in NicNames DNS Before Certificate Renewal

A CAA record says which certificate authorities may issue TLS certificates for your domain. Before adding one in NicNames DNS, identify every service that requests certificates for your website and subdomains. An incomplete list can stop a legitimate certificate from being issued or renewed.

Decide whether you need a CAA policy

CAA is optional. Without a CAA restriction, a publicly trusted certificate authority may issue a certificate after it validates control of the domain. A carefully maintained CAA policy narrows the issuers you authorize; it does not replace account security or Certificate Transparency monitoring. If you cannot identify all the issuers used by your hosting provider, CDN and other services, finish that inventory before changing DNS.

Check where your DNS is hosted

In your NicNames account, open Domains → ClassicDNS, select the domain, and open its DNS Settings. Review existing records before adding anything. If the domain uses another provider's authoritative nameservers, make the CAA change in that provider's DNS instead. Our DNS troubleshooting guide explains why the authoritative nameservers matter.

Build the issuer list first

Check who issues certificates for the root domain, www, other service subdomains and wildcard names. Hosting and CDN products can obtain certificates automatically. Ask each provider which CAA identifiers its certificate authorities require, including any backup issuers. A CAA record at the registered domain can affect its subdomains; a closer CAA record may override it, and CNAME targets can affect the check. Document those dependencies before narrowing permissions.

Read the fields in NicNames

In DNS Settings, Add record offers CAA as a record type. The editor shows Name, TTL, Flags, Tag, and CA Domain Name. Flags normally stay at 0. The Tag menu distinguishes ordinary issuance, wildcard issuance and violation-report destinations; choose the setting your certificate provider documents. Enter only the exact issuer identifier supplied by that provider in CA Domain Name. Do not copy an issuer from another site's example or remove an existing permitted issuer until you have checked the services that depend on it.

For example, Let’s Encrypt documents letsencrypt.org as its CAA identifier and explains that the issue property permits ordinary issuance; issuewild is used when wildcard issuance needs a different rule. That example is appropriate only when Let’s Encrypt is an issuer your domain actually uses. A provider may require more than one permitted authority.

Check the result and keep it current

After a planned change, check the CAA answers from the authoritative DNS service and confirm that your hosting or certificate provider can still issue and renew the certificates you need. Revisit the policy whenever you change hosting, CDN or certificate services. You can also monitor Certificate Transparency for unexpected issuance and review NicNames SSL certificate options for sites you manage.

CAA affects certificate issuance, not the validity of a certificate already in use. If a renewal fails, compare the current CAA policy with the issuing provider's requirements before editing records again.