How to Manage CAA Records in OzSpeed

CAA (Certificate Authority Authorization) Records are DNS records that specify which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for your domain. Managing these records enhances your domain’s security by preventing unauthorized certificate issuance.

Here’s how to manage CAA Records in OzSpeed hPanel:

---

Steps to Manage CAA Records in OzSpeed #

Step 1: Log in to OzSpeed hPanel #

1. Visit OzSpeed hPanel.
2. Enter your credentials and click Log In.

---

Step 2: Access DNS Zone Editor #

1. From the dashboard, navigate to the Domains section.
2. Select the domain for which you want to manage CAA Records.
3. Click Manage DNS or DNS Zone Editor.

---

Step 3: Add a New CAA Record #

1. In the DNS Zone Editor, scroll to the CAA Records section.
2. Click Add Record or Create Record.
3. Fill out the required fields:
   • Host/Name:
     • Enter @ for the root domain (e.g., example.com).
     • Specify a subdomain if applicable (e.g., www or secure).
   • Type: Select CAA.
   • Flag:
     • Use 0 for standard configurations.
     • Use 128 to indicate critical records that must be followed by the CA.
   • Tag:
     • Use issue to authorize a specific CA to issue certificates for your domain.
     • Use issuewild to authorize a CA to issue wildcard certificates.
     • Use iodef to specify an email or URL for violation reports.
   • Value:
     • Specify the CA or other details depending on the tag.
     • Example: letsencrypt.org for issuing certificates via Let’s Encrypt.
   • TTL (Time to Live): Use a default TTL (e.g., 300 seconds).
4. Click Save to create the record.

---

Step 4: Edit an Existing CAA Record #

1. Locate the CAA Record you wish to update.
2. Click Edit next to the record.
3. Modify the fields (e.g., flag, tag, or value) as required.
4. Save the changes.

---

Step 5: Delete a CAA Record #

1. Find the CAA Record you want to remove.
2. Click Delete next to the record.
3. Confirm the deletion.

---

Example CAA Record Configurations #

Host/Name	Type	Flag	Tag	Value	TTL
@	CAA	0	issue	letsencrypt.org	300
@	CAA	0	issuewild	digicert.com	300
@	CAA	0	iodef	mailto:admin@domain.com	300

---

Common Use Cases for CAA Records #

1. Authorize Specific Certificate Authorities:
   • Restrict SSL/TLS certificate issuance to trusted providers like Let’s Encrypt, DigiCert, or Sectigo.
2. Wildcard Certificates:
   • Use the issuewild tag to specify which CAs can issue wildcard certificates for your domain.
3. Violation Reporting:
   • Use the iodef tag to receive violation reports via email or a URL when unauthorized certificate issuance is attempted.

---

Troubleshooting CAA Records #

1. Certificate Requests Failing:
   • Ensure the CA you’re authorizing matches the one attempting to issue the certificate.
   • Check that the issue or issuewild tags are configured correctly.
2. Invalid Records:
   • Verify the syntax and ensure no conflicting CAA Records exist.
3. Changes Not Reflecting:
   • Clear your local DNS cache:
     • Windows: ipconfig /flushdns
     • macOS: sudo killall -HUP mDNSResponder.
   • Use a DNS propagation tool like dnschecker.org to verify global updates.

---

Additional Notes: #

• Backup DNS Settings:
  • Before making changes, back up your DNS records to ensure you can restore them if needed.
• Propagate Changes:
  • Allow up to 24–48 hours for global DNS propagation.
• Keep Records Updated:
  • Regularly review CAA Records to ensure they align with your security and certificate management needs.