• What is CAA record and how it works
• How to set up the CAA for the domain using Namecheap Basic/FreeDNS/PremiumDNS

Nowadays, when almost everyone embraces HTTPS, a lot of fraud attempts which can lead to certificate mis-issuances may occur.

To prevent this, the CAB Forum with assistance of IETF found a solution - CAA record.

On February 22nd, 2017, CAA checks were made mandatory due to the CAB ballot. More details can be found here .

Thus now, before issuing a certificate for some domain, CAs have to check this domain for any CAA records present, and decline the issuance if a CAA record is set up with another CA preference. However, if there is no CAA record set up, they are still allowed to issue one.

Now we can see that reasons behind using a CAA record can be the following:

- You want to limit your domain to be issued a certificate only by your trusted certificate authorities.
- You want a Certificate Authority to implement additional checks to reduce the risk of unintended certificate mis-issue.

There are several types of CAA records with different parameters, each serving a different purpose. They are described below: 

example.com. IN CAA 0 issue "comodoca.com"
example.com. IN CAA 0 issue "ssl.com"

The CAA records above allow Sectigo CA, formerly Comodo CA, and SSL.com to issue certificates for example.com.

Please note that a CAA record with no CA specified under the issue parameter will restrict certificate issuance for the domain name in question: paragraph 5.2

Also, keep in mind that allowing only one CA may lead to rejected certificate issuance attempts from another CA.

example.com. IN CAA 0 issuewild "comodoca.com"
example.com. IN CAA 0 issuewild "ssl.com"

The CAA records above work in a similar way, but they should be used when a wildcard certificate is going to be issued for the example.com domain.

The values are correct: SSL.com uses ssl.com for both issue and issuewild, and SSL.com’s own CAA article also shows comodoca.com as the Comodo/Sectigo authorization value.

example.com. IN CAA 0 iodef "mailto:admin@example.com"
example.com. IN CAA 0 iodef "https://admin.example.com"

The ‘iodef’ record is the record which defines the way domain holder will be notified in case of any issuance policy violation spotted by Certificate Issuer.

In order to set up the desired CAA Record you should check if your DNS provider allows CAA Record implementation. This link (https://sslmate.com/caa/support) can be helpful.

If you use Cloudflare, CAA records can be set up there as well. You can find the guide at https://support.cloudflare.com/hc/en-us/articles/115000310792-Configuring-CAA-Records-

This tool might be used to generate the CAA record.

Additional information about how CAA treats different types of domain pointing can be found here.

Notes:

• If the domain is using Namecheap Basic, Premium DNS or FreeDNS, the CAA record can be added via "Advanced DNS" as described in the following section.
• If it is pointed to Namecheap Web Hosting DNS, the record can be added via DNS zone via both cPanel and WHM, the record settings for cPanel can be found here.
• To create the record via API, please follow this guide.
• If the domain is using DNSSEC, ensure that it is configured correctly or maintain it. Otherwise, certificate issuance will be paused until the DNSSEC issues are resolved.
• If your domain already has CAA records for Sectigo, add the CAA records for SSL.com as well before requesting an SSL.com certificate. Otherwise, the issuance of new SSL.com certificates will fail. You can find the required CAA records here:
  example.com. IN CAA 0 issue "ssl.com"
  example.com. IN CAA 0 issuewild "ssl.com"

How to set up the CAA for the domain using Namecheap Basic/FreeDNS/PremiumDNS

• Sign into your Namecheap account (The Sign In option is available in the header of the page).
• Select Domain List from the left sidebar and click on the Manage button next to your domain.

• Navigate to the Advanced DNS tab at the top of the page.

• Find the Host records section and click on the Add New Record button.

• Select CAA Record for Type.

• Specify the corresponding domain name or subdomain in the Host field.

• Select the required Tag value from the drop-down.