FAQs

How to add a CAA record to authorize Sectigo to issue certificates for your domain

Updated on July 13, 2026

Overview

By the end of this article, you will be able to add a Certification Authority Authorization (CAA) record to your Domain Name System (DNS) so that Sectigo is authorized to issue certificates for your domain. A CAA record tells a certificate authority (CA) whether it may issue a certificate for your domain before issuance, which helps you enforce your organization’s certificate policies and reduce exposure to mis-issuance. This article defines CAA records, lists the domain names and property tags that authorize Sectigo, gives the steps to add a CAA record and resolve CAA check pre-sign failures, identifies the DNS servers that support CAA, and explains how Sectigo applies CAA checks to Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate issuance.

What is a CAA record?

A Certification Authority Authorization (CAA) record is a Domain Name System (DNS) record that specifies which certificate authorities (CAs) are allowed to issue certificates for your domain. Its purpose is to give domain owners control over certificate issuance and to reduce exposure to vulnerabilities in CA validation systems.

Before issuing a certificate, a CA checks your domain’s CAA records and denies the request if it is not listed. If no CAA record is present, any CA may issue a certificate for the domain. CAA records can apply to an entire domain or to specific hostnames, are inherited by subdomains, and can govern single-name certificates, wildcard certificates, or both.

Two dates set the context for CAA enforcement:

Since September 8, 2017, all certificate authorities have been required to check CAA DNS records before issuing SSL certificates.

Since September 15, 2024, Sectigo has enforced CAA lookups for publicly trusted S/MIME certificates, following the “SHOULD” requirement of the CA/Browser (CA/B) Forum.

Which domain names authorize Sectigo?

To authorize Sectigo, your Certification Authority Authorization (CAA) record must reference a Sectigo-recognized domain name in the correct property tag. Sectigo recognizes the following domain names as authorizing it to issue certificates:

Property tag	Applies to	Recognized domain names
issue	SSL/TLS certificates	sectigo.com trust-provider.com usertrust.com
issuewild	Wildcard SSL/TLS certificates	sectigo.com trust-provider.com usertrust.com
issuemail	S/MIME certificates	sectigo.com trust-provider.com usertrust.com

How to add a CAA record to authorize Sectigo

Adding a Certification Authority Authorization (CAA) record for a Sectigo-recognized domain resolves CAA check pre-sign failures and authorizes Sectigo to issue certificates. For detailed help accessing and editing your records, contact your domain registrar.

Open your domain’s Domain Name System (DNS) zone file.

Add a CAA record for each certificate type you need, under $ORIGIN yourdomain.com. See valid CAA resource record values in the DNS server sections below.

Save the zone file and allow time for DNS propagation.

Example zone file entries:

Figure 1: Example CAA record entries used to authorize Sectigo certificate issuance.

$ORIGIN yourdomain.com

CAA 0 issue "sectigo.com"

CAA 0 issuewild "sectigo.com"

CAA 0 issuemail "sectigo.com"

A single CAA record at the domain level applies to all hosts and subdomains (for example, www.yourdomain.com, shop.yourdomain.com, and checkout.yourdomain.com).

To verify success, request or retry your certificate. If the CAA record is published correctly, the CAA check pre-sign failure no longer occurs and issuance proceeds.

DNS servers that support CAA records

The following Domain Name System (DNS) servers support Certification Authority Authorization (CAA) records for SSL certificates. For versions earlier than those listed, use Request for Comments (RFC) 3597 syntax where noted.

DNS server	Minimum native CAA support	Notes
BIND	9.9.6	Prior to 9.9.6, use RFC 3597 syntax
NSD	4.0.1	Prior to 4.0.1, use RFC 3597 syntax
PowerDNS	4.0.0	—
Knot DNS	2.2.0	—
Google Cloud DNS	Supported	Use generic format
DNSimple	Supported	Use generic format

Standard zone file format

For BIND (9.9.6+), PowerDNS (4.0.0+), NSD (4.0.1+), and Knot DNS (2.2.0+):

sectigo.com. IN CAA 0 issue "sectigo.com"

Generic format

For Google Cloud DNS and DNSimple:

0 issue "sectigo.com"

For additional reference, see RFC 6844.

How Sectigo applies CAA checks to S/MIME issuance

Starting September 15, 2024, before issuing a Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate that certifies an email address, the certificate authority (CA) should check for a Relevant Resource Record Set (RRSet). This check became mandatory on March 15, 2025. Sectigo follows the “SHOULD” requirement as of September 15, 2024.

CAA behavior differs between certificate types:

For S/MIME, the check applies to the domain part of each email address — the suffix of the SAN.rfc822Name value, after the “@” — and inspects the issuemail property. Here, SAN means Subject Alternative Name.

For SSL, the check applies to the entire Fully Qualified Domain Name (FQDN), which is the full SAN.dNSName value, and inspects the issue and issuewild properties.

Sectigo does not currently support parameters that let domains further restrict issuance.

Expected outcomes for S/MIME certificates

The following outcomes apply specifically to S/MIME issuance, based on the Relevant Resource Record Set (RRSet):

Relevant RRSet condition	S/MIME issuance
The RRSet is empty	Allowed
The RRSet contains no issuemail property	Allowed
The RRSet has multiple issuemail properties — one matching the CA’s issuer domain name and one not	Allowed
The RRSet has a single issuemail property with an empty issuer domain name	Prohibited
The RRSet has a malformed issuemail property that does not conform to Augmented Backus-Naur Form (ABNF) syntax	Prohibited
The RRSet sets the critical flag for a CAA property the CA does not support	Prohibited

For issuemail property examples, see RFC 9495. Contact your domain registrar to confirm whether CAA record support for S/MIME certificates is available.

Similar questions