CAA records

A CAA record is a DNS setting that lists which certificate authorities may issue certificates for your domain name. It is not a certificate itself, and it does not encrypt traffic. If you publish CAA at all on a LogicWeb cPanel account, include letsencrypt.org so AutoSSL and Let’s Encrypt can still issue. With no CAA record, any CA may issue, and that remains normal for most sites.

How a CAA record is built

The record sits on the hostname you care about, or a parent name can supply it by inheritance. Flags are almost always set to 0. Use the issue tag for ordinary hostnames and issuewild when you mean wildcards. The value is a CA domain such as letsencrypt.org, or another CA you chose on purpose. You may list more than one CA. The optional iodef tag points to a mailbox for abuse reports; it does not authorize issuance.

Empty CAA policy means any CA may issue for the name. Most accounts here run that way without trouble. Add CAA when you want a real policy, such as allowing Let’s Encrypt and blocking a leftover vendor CA. Skip it when a checklist simply told you every zone must have one.

What AutoSSL needs to see

Check the public DNS answer, not only what a control panel cached earlier:

dig +short example.com CAA

Empty output means any CA may issue, so AutoSSL can proceed. A line that includes letsencrypt.org is fine for our free certificates. A line that only names a CDN’s CA blocks AutoSSL, and the status text may mention CAA in a way that feels opaque if you copied old DNS. An issuewild policy covers wildcards only; it does not replace issue for the apex name.

TTL still applies after you change CAA, so wait for the new answer to show, then run AutoSSL again. If you intentionally block Let’s Encrypt because a paid OV certificate lives on that name, treat that as a documented policy. An undocumented CAA entry often becomes an outage later, when the paid cert expires and nobody remembers why domain-validated replacement could not run.

Practical checklist

1. Decide whether you need a CA restriction at all for this name.
2. If you do, add issue (and issuewild only when wildcards matter) with letsencrypt.org when AutoSSL should work.
3. Publish the change at your DNS host, wait for TTL, and confirm with dig.
4. Run AutoSSL on the cPanel account and confirm the certificate issues cleanly.

Nameservers for domains that use our DNS are ns1.logicweb.com and ns2.logicweb.com. After CAA looks right in public DNS, AutoSSL can request Let’s Encrypt certificates on shared hosting without root access or manual certificate uploads.