CAA values for our certificates
CAA records are optional. If your domain or a parent domain has any, one must allow the CA: sectigo.com for Sectigo, Comodo and PositiveSSL, or digicert.com for DigiCert, GeoTrust, Thawte and RapidSSL.
Why a live record can still fail
Answers here come from one public resolver and may be cached for a few minutes. The CA checks from several network locations, so the record must answer the same everywhere; geo-DNS, firewalls or broken DNSSEC can still make validation fail.
Common questions
Do I need a CAA record?
No. CAA is optional, but if any CAA records exist on your domain or a parent domain, one of them must allow the CA.
My record shows here but validation still fails.
Wait a few minutes for caches to expire, make sure the record is visible from outside your network, and check DNSSEC with your DNS host.
What do SPF, DKIM and DMARC have to do with SSL?
Nothing directly. They protect email sent from your domain; we show them because the same lookup makes gaps easy to spot.