Cloudflare dashboard: DNS → Records → Add record. Type = CAA. Name = @ for the root domain. Tag = issue (or issuewild / iodef). Value = the CA identifier (e.g., letsencrypt.org) or contact URL. Flags = 0 (advisory). Save. Add multiple CAA records for multiple allowed CAs. Include an iodef record with your security contact so CAs report violations. Cloudflare’s proxy doesn’t affect CAA — CAs check DNS directly. Verify with the CAA record lookup. Read the CAA glossary entry and the CAA learning article for context.
All questions
How do I add a CAA record in Cloudflare?
Read the full guide
What Is a CAA Record?
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.