All questions
Q & A DNS Records · September 11, 2026

Can I still get new SSL certificates if I publish CAA?

Yes — CAA only restricts which CAs can issue. If you list Let’s Encrypt and DigiCert in CAA, both can issue for your domain. If you list only Let’s Encrypt and later try to get a cert from Sectigo, Sectigo will refuse. Update CAA to include the new CA before requesting a cert from them.

Read the full guide
What Is a CAA Record? Certificate Authority Authorization Explained
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.
Related questions
How do I add a CAA record in Cloudflare? How does CAA tree climbing work? What happens if I don't publish a CAA record? What is the iodef tag for? Which CAs check CAA records?