How to add a CAA record on IONOS (formerly 1and1)

Updated on 28 Oct 2024

Step-by-step instructions for adding a CAA record on IONOS

A CAA record is a DNS record that says which certificate authorities may issue SSL certificates for your domain. Authorities are required to check it before they issue, but you are not required to have one. It is still worth the five minutes: it is cheap insurance against somebody obtaining a certificate for your domain by mistake.

IONOS is what 1and1 has been called since 2019. If your account still says 1&1, it is the same one.

How to add a CAA record on IONOS

  1. Sign in to your IONOS account and go to Domains & SSL.
  2. Next to the domain you want to protect, open the gear menu and choose DNS.
  3. Click ADD RECORD and choose CAA.
  4. Fill in the fields:

Adding a CAA record on IONOS

  • Host name: enter @ for your domain. The @ acts as a wildcard and covers the domain with www and all of its subdomains.
  • Value: the domain of the certificate authority you are authorising. The authority itself will tell you what to use — digicert.com or sectigo.com, for instance.
  • Flag: choose 0 or 128. With 0 (not critical), an authority ignores any entry in the record it cannot interpret. With 128 (critical), if it cannot interpret an entry it will not issue the certificate.
  • Type: choose Issue to authorise ordinary certificates.
  • TTL: optional. The default is fine.
  1. Click Save. The change takes effect immediately.

Authorising wildcard certificates

An Issue record is not enough for a wildcard certificate. If you are protecting *.yourdomain.com, add a second CAA record that is identical except for Type, which should be Issuewild.

A CAA record with Issuewild on IONOS

Preventing any certificate at all

If a domain should have no certificates whatsoever, you can say so: a CAA record with an empty Value — or a ; — tells every authority that none of them is authorised. Useful for domains you only use for email, or that you hold without a website on them.