Add CAA Records in the Linode Cloud Manager

Posted on , Updated on , by Linode .

Traducciones al Español
Estamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
Try this guide to receive $100 at signup on a new account.

Certification Authority Authorization (CAA) is a type of DNS record that allows the owner of a domain to specify which certificate authority (or authorities) are allowed to issue SSL/TLS certificates for their domain(s). This quick answer shows you how to set up CAA records on your Linode.

Add a Single CAA Record

  1. Log in to the Linode Cloud Manager

  2. Select the Domains link in the sidebar.

  3. Select the domain you want to add the record to, or add a domain if you don’t already have one listed.

  4. Under the CAA Record section, select Add a CAA record. A form with the following fields will appear:

    Name: The subdomain you want the CAA record to cover. To apply it to your entire website (for example:, leave this field blank. To limit the record’s application to a subdomain on your site, (for example:, enter the subdomain’s name into the form field (for example: subdomain).


    • issue - Authorize the certificate authority entered in the Value field further below to issue TLS certificates for your site.

    • issuewild - Same as above, with the exception that you were issued a wildcard certificate.

    • iodef - URL where your CA can report security policy violations to you concerning certificate issue requests.

    Value: If the issue or issuewild tag was selected above, then the Value field takes the domain of your certificate issuer (for example: If the iodef tag was selected, the Value field takes a contact or submission URL (http or mailto).

    TTL (Time to Live): Time in seconds that your new CAA record will be cached by Linode’s name servers before being refreshed. The Default selection’s TTL is 300 seconds, which is fine for most cases. You can use the dig command to view the remaining time your DNS records will be cached until refreshed. Replace with your site’s domain or subdomain in the command below:

    [email protected]:~# dig +nocmd +noall +answer     167 IN  A
  5. Click the Save button when finished. The CAA record should be fully propagated within the TTL duration.

Add Multiple CAA Records

Multiple CAA records must be added individually. If your site was issued a TLS certificate by Let’s Encrypt, but your subdomain uses a Symantec certificate, you would need two different CAA records. A reporting URL for the iodef tag would also need its own record. Those three would look something like this:

Multiple CAA records

Your Feedback Is Important

Let us know if this guide helped you find the answer you were looking for.