CAA record
In one line
A CAA record is a DNS entry that lists which certificate authorities are allowed to issue SSL certificates for your domain. If a CAA record exists and leaves an authority out, that authority must refuse to issue one.
A short list of who may vouch for you
An SSL certificate is what gives your site its padlock. Certificates are issued by certificate authorities. A CAA record, short for Certification Authority Authorization, lets you name the authorities you trust to do that for your domain.
Before issuing a certificate, an authority checks your DNS for CAA records. If there are none, any authority may issue one. If there are some, only the authorities named in them may.
Why most people never notice it
Many domains have no CAA record at all, and everything works. You might add one deliberately, as a security step, so that a stray request at an authority you never use cannot produce a certificate for your name.
The trouble starts when a CAA record was added years ago, or by a previous host, and names only one authority. Then you connect your domain to a new service that uses a different authority, and its certificate request is refused. The site loads without a padlock, or not at all over https.
How to fix a CAA block
Look for CAA records on your domain, both on the exact name and on the apex, because authorities check up the tree. If one exists, add a new CAA record naming the authority your new host uses, next to the existing one. You do not need to remove the old one unless you no longer use it.
Each CAA record has a tag. The usual one is issue, followed by the authority's identifier. Your host's help pages list the identifier to use.
Changes to CAA records follow the same caching rules as other records, so give a fix a little time before you retry. Once the authority can see the new record, the certificate usually arrives without any further action from you.
Checking yours
The DNS checker reports any CAA record that would block certificates for a Mini Casa connection. Custom domains are in preview, and the connection screen checks the certificate step when domain connection is available for your account. The custom domain guide covers it, and the custom domains page says what is ready.
Questions people ask
Do I need a CAA record?
No. Without one, any certificate authority may issue certificates for your domain, which is how most domains work. Add one only if you want to limit issuance to the authorities you use.
Why is my certificate stuck after connecting a domain?
A CAA record that leaves out your host's certificate authority is a common cause. Add a CAA record naming that authority, wait for the change to show, then retry the certificate step.